A China-linked advanced persistent threat (APT) group, identified as UAT-7810, has been observed expanding its network of compromised devices, known as Operational Relay Box (ORB) networks, and equipping it with new custom malware. Researchers at Cisco Talos assessed with high confidence that UAT-7810 is a China-nexus group. These ORB networks consist of hijacked routers and other devices that are rented out to other malicious actors to mask the origin of their cyberattacks.
UAT-7810 has been maintaining an ORB network called LapDogs since at least 2025. The group's primary function appears to be the creation of this infrastructure for other APT groups. By compromising a sufficient number of devices, UAT-7810 enables separate China-nexus APT groups to conceal their espionage activities targeting high-value entities.
To expand its network, UAT-7810 has been exploiting known but unpatched vulnerabilities in edge devices. This tactic relies on organizations failing to implement security updates. Specifically, the group has targeted flaws in Ruckus wireless routers since 2025 and, earlier this year, began exploiting a vulnerability in ASUS routers to incorporate them into the network.
In addition to expanding its infrastructure, UAT-7810 has developed a new, upgraded backdoor malware named LONGLEASH. This tool is an evolution of a previous malware and now includes proxying capabilities, allowing it to relay commands to other infected machines.
Cisco Talos also uncovered two previously unknown backdoors. DOGLEASH is designed to execute commands on compromised Linux devices. The second is JARLEASH, a Java-based tool used for managing the group's servers. Comments within a configuration file for JARLEASH were written in Simplified Chinese, which Talos noted as an indicator of Chinese-speaking operators.
The researchers also identified a test program developed by UAT-7810 that targets MIPS-based devices. This suggests the group is actively refining its tools to support the diverse hardware that comprises its ORB network. Cisco Talos stated that its tracking indicates the group's malware and servers remain active.
