The threat actor UAT-7810 is expanding its ORB network by deploying LONGLEASH malware, an advanced evolution of the previously documented SHORTLEASH backdoor. LONGLEASH enhances command-and-control capabilities with reverse shell access, multiple proxying protocols (HTTP, DNS, SOCKS, TCP, ICMP, UDP), SMTP client/server functions, TLS and PKI support, and self-removal mechanisms. It can also serve as an intermediate C2 server forwarding commands and data between infected nodes. Initial access is primarily gained by exploiting known (n-day) vulnerabilities in internet-facing Ruckus routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717) and ASUS AiCloud routers (CVE-2025-2492). Additional malware tools discovered include DOGLEASH, a Linux backdoor with shell command execution and arbitrary code execution capabilities; JARLEASH, a Java-based administrative tool with file management and FTP/SFTP/Netcat server functions; and LEASHTEST, a utility to test MIPS IoT device compatibility with malware operations. This ORB infrastructure facilitates proxying of network traffic for China-aligned APTs, complicating detection and attribution efforts.

The LONGLEASH malware and associated toolset enable the threat actor to compromise and control internet-facing networking devices, primarily unpatched Ruckus and ASUS routers. This expands the ORB network infrastructure used to proxy malicious traffic, making detection and attribution more difficult. The malware supports multiple proxy protocols and can act as an intermediate command-and-control server, increasing operational flexibility for the threat actor. The exploitation of known vulnerabilities indicates that unpatched devices are at risk of compromise. The presence of backdoors and administrative tools allows for persistent access, remote command execution, and potential lateral movement within targeted networks.

Patch all affected networking devices promptly by applying vendor security updates addressing the known vulnerabilities CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 (Ruckus routers), and CVE-2025-2492 (ASUS AiCloud routers). Since the campaign exploits known (n-day) vulnerabilities, maintaining up-to-date firmware is critical. Network defenders should also review Cisco Talos’ report and indicators of compromise (IoCs) linked to UAT-7810 activity to detect and remediate infections. No vendor advisory or official fix status is provided in the input; therefore, patch status is not yet confirmed — check vendor advisories for current remediation guidance. Implementing network segmentation and restricting internet-facing management interfaces can reduce exposure. Monitor for unusual proxying activity and command-and-control communications consistent with LONGLEASH capabilities.