China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-22653 +1 in the same advisory: …22658 | In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) before 3.6.2.0.795, SmartZone 300 (SZ300) before 3.6.2.0.795, Virtual SmartZone (vSZ) before 3.6.2.0.795, ZoneDirector 1100 9.10.2.0.130, ZoneDirector 1200 10.2.1.0.218, ZoneDirector 3000 10.2.1.0.218, ZoneDirector 5000 10.0.1.0.151, a vulnerability allows attackers to exploit the official image signature to force injection unauthorized image signature. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2023-25717 | Unauthenticated RCE via Command Injection in Ruckus Wireless Admin ≤10.4 CVE-2023-25717 is a command-injection flaw (CWE-94) in Ruckus Wireless Admin through version 10.4, the management interface used with Ruckus/CommScope SmartZone controllers. An unauthenticated attacker triggers it by sending a crafted HTTP GET request to /forms/doLogin, injecting shell commands (e.g., $(curl ...) substrings) into the login_username or password parameters, which the device executes. Successful exploitation yields remote code execution with full compromise of the management interface, and the same code path is also tied to CSRF/SSRF issues. Any organization running an internet-exposed Ruckus Wireless Admin or SmartZone management endpoint is affected, and the flaw has been actively exploited in the wild — botnet campaigns (notably Andoryu) used it to recruit devices, and CISA added it to the Known Exploited Vulnerabilities catalog on 2023-05-12; EPSS puts the 30-day exploitation probability at 98.1%. Do: Apply vendor updates per Ruckus/CommScope instructions for Wireless Admin (beyond 10.4) and SmartZone firmware, and per CISA KEV guidance disconnect any product that is end-of-life if it cannot be patched. Restrict the management interface so /forms/doLogin is not reachable from the internet, and review access logs for unauthenticated GET requests containing shell syntax such as $( ) in the login_username or password parameters to detect prior exploitation. | 9.8 | 98% | KEV PoC |
| largeon the order of 10,000–100,000 internet-exposed management interfaces (unknown exact count) | |
| CVE-2025-2492 | An improper authentication control vulnerability exists in AiCloud. An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information. NVD description · AI analysis pending | 9.2 | 1% | — | — |
Full article512 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 08, 2026Malware / Network Security
A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by breaking into internet-facing networking devices.
According to findings from Cisco Talos, UAT-7810 is an advanced persistent threat (APT) actor that's responsible for maintaining and proliferating LapDogs, an ORB network that first came to light in June 2025.
"UAT-7810 is most likely tasked with establishing Operational Relay Box (ORB) networks that can then be leveraged by associated secondary threat actors to conduct their own malicious attacks against high value targets," researchers Jungsoo An, Asheer Malhotra, Vanja Svajcer, and Brandon White said.
One such China-nexus threat actor that has leveraged the infrastructure in its own attacks is UAT-5918, which has been linked to cyber attacks targeting critical infrastructure entities in Taiwan since at least 2023 with an aim to establish persistent access within victim environments.
The latest findings indicate that UAT-7810 has continued to develop their custom malware dubbed ShortLeash with a newer version that's codenamed LONGLEASH. Also put to use by the threat actor are two other previously unreported tools -
- DOGLEASH, a passive backdoor that can execute arbitrary shellcode on a compromised Linux device
- LEASHTEST, an ELF binary that's used for testing certain functionality, like creating a thread, a child process, or an async timer, on MIPS-based embedded devices
"UAT-7810 used at least four new servers to host a variety of minor variations of DOGLEASH to deploy against compromised targets," the researchers added. "An additional Java-based (JAR package) backdoor that we track as 'JARLEASH' was also deployed by UAT-7810 on at least one of the three servers for administration purposes, including file management, FTP, SFTP, and Netcat."
Attack chains mounted by the hacking crew are known to weaponize known vulnerabilities in unpatched Ruckus wireless routers, such as CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717. Campaigns observed earlier this year have also singled out ASUS AiCloud Routers susceptible to CVE-2025-2492, indicating potential attempts to broaden the ORB network.
ShortLeash incorporates a backdoor capable of contacting an external server, hosting a web server, and acting as both a command-and-control (C2) server and client. Its successor, LONGLEASH, packs in additional functionality, pointing to an active development cycle. Some of the newer features are listed below -
- An executor component that enables proxying functions using HTTP, DNS, SOCKS, TCP, ICMP, and UDP protocols, manages network connections to other servers, authorizes clients, and removes the implant and all traces from the server if any tampering attempts are detected
- Act as an intermediate C2 server to relay commands and data from the primary C2 and forward it to its peers
"The development and use of LEASHTEST signifies that even though they have developed LONGLEASH, a full-fledged backdoor framework, UAT-7810 is still actively testing functionality on MIPS platforms and may not be completely confident of its behavior on MIPS devices," Talos said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/07/china-linked-uat-7810-expands-orb.html