The threat actor UAT-7810, associated with China, is actively expanding its covert infrastructure by exploiting unpatched vulnerabilities in Ruckus and ASUS routers. They deploy sophisticated custom malware, including LONGLEASH and DOGLEASH backdoors, to establish Operational Relay Box (ORB) networks. These ORB networks serve as decentralized proxy infrastructures that enable secondary threat actors to obfuscate their attack origins and bypass traditional perimeter defenses. The group’s focus on edge device compromise and multi-platform malware development indicates a strategic investment in resilient and evasive attack infrastructure. The exploitation vector is based on known vulnerabilities in specific router models, emphasizing the importance of patching. Cisco Talos provides indicators of compromise (IOCs) to detect and block this malware suite. No confirmed exploits in the wild have been documented.

The exploitation of known vulnerabilities in Ruckus and ASUS routers allows UAT-7810 to build covert proxy networks that create significant blind spots in network defenses. This infrastructure facilitates stealthy routing of malicious traffic and enables other advanced persistent threat (APT) groups to launch attacks against high-value targets. The compromised edge devices undermine perimeter security by acting as decentralized proxies, complicating detection and attribution efforts. The threat actor’s use of custom malware backdoors increases the resilience and evasiveness of their infrastructure. No direct exploitation incidents have been confirmed in the wild, but the potential for indirect impact via secondary threat actors is significant.

A fix is available through patching: defenders must ensure that all Ruckus and ASUS routers are fully updated with the latest security patches to remediate the known vulnerabilities exploited by UAT-7810. Monitoring network traffic for unusual proxying behavior or unauthorized connections on edge devices that typically do not run complex services is recommended. Utilize the provided indicators of compromise (IOCs) from Cisco Talos to detect and block the LONGLEASH and DOGLEASH malware suite. Since the threat actor exploits n-day vulnerabilities, timely patch management is the primary mitigation. No vendor advisory indicates that no action is required or that the issue is already mitigated.