Chinese hackers develop LONGLEASH malware to expand ORB network

Chinese threat actors, identified as UAT-7810, are actively developing and deploying new malware to enhance their Operational Relay Box (ORB) network. This network, previously documented as a secure relay infrastructure for other China-aligned advanced persistent threat groups, is being expanded by compromising internet-facing networking devices, with a particular focus on unpatched Ruckus routers. The ORB network allows threat actors to route their network traffic through compromised regional devices, mimicking legitimate local infrastructure to evade detection and obscure their origins.

Recent research by Cisco Talos has uncovered several new tools used by UAT-7810 in this ongoing campaign. These include LONGLEASH, an updated version of the previously known SHORTLEASH backdoor; DOGLEASH, a backdoor designed for Linux systems; JARLEASH, an administrative tool; and LEASHTEST, a utility for testing device capabilities.

The LONGLEASH malware represents a significant evolution from its predecessor, SHORTLEASH. While SHORTLEASH offered capabilities such as command-and-control (C2) communications, web server hosting, and network tunnel management, LONGLEASH expands upon these with additional functionalities. These new capabilities include a reverse shell, proxying for various protocols like HTTP, DNS, SOCKS, TCP, ICMP, and UDP, as well as SMTP client and server features. LONGLEASH also incorporates support for TLS and PKI, a self-removal mechanism to erase traces if tampering is detected, and the ability to act as an intermediate C2 server, relaying commands and data between infected devices.

In addition to LONGLEASH, the threat actors are utilizing DOGLEASH, a lightweight Linux backdoor. This malware is deployed through web shell scripts and establishes a listening TCP port. It authenticates incoming requests using a hardcoded password and supports the execution of shell commands, file access and modification, retrieval of operating system information, and arbitrary code execution directly within the host's memory.

JARLEASH is a Java-based administrative tool that provides web-based file management capabilities. It also includes integrated FTP, SFTP, and Netcat server functionality, offering a versatile platform for managing compromised systems.

The LEASHTEST utility appears to be designed to assess the capabilities of MIPS Internet of Things (IoT) devices. Its purpose is likely to determine if these devices can perform functions necessary for malware operations, potentially aiding in the refinement of LONGLEASH's support for MIPS architecture.

UAT-7810 primarily gains initial access by exploiting known, unpatched vulnerabilities in networking devices. Specific vulnerabilities exploited in Ruckus routers include CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717. Additionally, ASUS AiCloud routers have been targeted through the exploitation of CVE-2025-2492.

Cisco Talos researchers observe that UAT-7810 is actively working to expand its ORB infrastructure. This expansion involves replacing or augmenting the older SHORTLEASH malware with the more advanced LONGLEASH, while simultaneously broadening their toolkit with new malware like DOGLEASH and JARLEASH. The ongoing development and deployment of these tools underscore the persistent efforts by this threat group to maintain and grow their clandestine network infrastructure. Further details, including indicators of compromise, are available in the full Cisco Talos report.