UAT-7810 LONGLEASH: Chinese APT Hijacks Ruckus Routers to Build Invisible Spy Network

An Operational Relay Box (ORB) network is a distributed infrastructure of compromised internet-facing devices that routes malicious traffic through geographically local nodes, making an APT group's activity appear to originate from trusted regional sources. UAT-7810 operates the LapDogs ORB network by chaining infected Ruckus routers into a multi-hop relay architecture. Traffic enters through an upstream controller, passes through one or more intermediate relay nodes, and exits at a device geographically proximate to the target. At no point does the malicious connection directly touch the threat actor's actual infrastructure.

LONGLEASH is the linchpin of this design. The malware installs on the compromised router and acts simultaneously as a slave node receiving instructions from a controller and as an intermediate C2 server forwarding instructions to other infected devices. This dual-role capability, absent from the earlier SHORTLEASH backdoor, is what enables the layered chain architecture. LONGLEASH supports six proxy protocols: HTTP, DNS, SOCKS, TCP, ICMP, and UDP. Each protocol option allows the malware to blend traffic into the legitimate protocol mix of a given network, with ICMP tunneling particularly effective in environments that block outbound TCP.

The ORB network serves more than one threat actor. UAT-7810 builds and maintains the LapDogs infrastructure, and associated China-nexus groups including UAT-5918 use the relay capacity to conduct their own intrusion operations. Mandiant's analysis of China-aligned ORB networks shows that IOC-based defenses are increasingly ineffective because relay nodes are continuously cycled. Defenders who rely solely on blocking known malicious IPs will miss ORB-routed traffic entirely.

UAT-7810 deploys four specialized malware families, each purpose-built for a distinct role in the compromise lifecycle. LONGLEASH is the primary network relay tool. DOGLEASH is the passive backdoor that provides persistent command execution on compromised Linux devices. JARLEASH is a Java-based administrator tool deployed for file management, FTP and SFTP server deployment, and Netcat functionality. LEASHTEST is a MIPS architecture testing binary used to verify that a target device is suitable for full compromise before deployment.

LONGLEASH is the most technically sophisticated of the four. The MIPS-compiled version uses the asynchronous Boost.Asio library to maximize network throughput and minimize blocking time, a design choice indicating active performance engineering. The malware's reverse shell capability gives an operator direct system access, while the self-removal function destroys all compromise evidence if tampering is detected. JARLEASH configuration files contain comments written in Simplified Chinese, a hard attribution indicator placing development within a Chinese-language operational environment.

DOGLEASH operates as a passive socket listener, meaning it generates no outbound traffic until an operator connects to it. The 62-plus unique hashes documented by Talos indicate that UAT-7810 regularly compiles fresh DOGLEASH variants to defeat signature-based antivirus detection. Each variant is functionally identical: it executes arbitrary shellcode in memory, reads files, renames files to create backups before modification, and retrieves OS metadata for device fingerprinting. Cisco Talos released five ClamAV detection signatures and five Snort rules covering LONGLEASH and DOGLEASH across multiple CPU architectures.

UAT-7810 is a China-nexus advanced persistent threat group that Cisco Talos assesses with high confidence is aligned with Chinese state interests. The group's primary mission is not traditional espionage but infrastructure provisioning: building and maintaining the LapDogs ORB network so that secondary China-aligned threat actors can conduct high-value intrusions while hiding behind geographically local relay traffic. This service-provider model for state-sponsored espionage makes UAT-7810 an enabler rather than a direct perpetrator, and attribution of downstream attacks to the correct actor correspondingly harder for defenders.

The strongest attribution indicator is linguistic. JARLEASH configuration files contain code comments written in Simplified Chinese, an artifact indicating the tool was developed by a native Simplified Chinese speaker or a team working in a Chinese-language environment. Secondary indicators include the operational overlap with UAT-5918, a separate China-nexus intrusion group documented using the LapDogs ORB relay capacity for its own campaigns. The tool-sharing relationship suggests either a collaborative structure or shared development infrastructure within the broader Chinese APT ecosystem.

UAT-7810 follows the playbook for China-nexus ORB network operators documented by Mandiant: shifting infrastructure responsibility from direct procurement to large-scale compromise of SOHO routers and IoT devices, continuously refreshing the node pool to defeat IOC-based defenses. Similar persistent infrastructure patterns have been documented in other nation-state actor profiles, including APT campaigns targeting critical infrastructure and power sector organizations that share the same long-dwell-time backdoor approach. No public indictment or OFAC sanction has named UAT-7810 or any individual operator as of July 2026.

UAT-7810 uses a focused set of techniques reflecting the group's infrastructure-building mission. The tactics span initial access, command and control, and defense evasion, with each technique selected to maximize the operational lifespan of a compromised relay node.

T1190 (Exploit Public-Facing Application) is UAT-7810's primary initial access technique. The group targets internet-exposed network management interfaces on Ruckus and ASUS routers with published CVEs, prioritizing devices unlikely to receive rapid patching from SMB and enterprise network operations teams. The exploitation phase requires no user interaction and leaves minimal forensic evidence on the device.

T1090 (Proxy) is the core operational technique. LONGLEASH converts each compromised device into a multi-protocol proxy that forwards traffic for upstream APT groups. By chaining relay nodes across different geographic regions, UAT-7810 ensures that the ultimate source of a sponsored intrusion resolves to a geographically plausible IP near the target, defeating geolocation-based threat intelligence blocking.

T1071 (Application Layer Protocol) covers LONGLEASH's use of HTTP, DNS, SOCKS, TCP, ICMP, and UDP as carrier protocols for C2 communications. DNS and ICMP tunneling are particularly evasive: most perimeter security tools focus on TCP and HTTP traffic, and ICMP-encapsulated command channels are frequently allowed through restrictive firewall policies.

T1070 (Indicator Removal) applies to LONGLEASH's self-removal capability: the malware deletes itself from the device if tampering is detected, eliminating forensic artifacts and forcing investigators to reconstruct activity from network logs. Nation-state actors increasingly blend network intrusion with supply chain staging, a pattern also documented in nation-state supply chain attacks targeting developer toolchains.

Active C2 infrastructure confirmed by Cisco Talos includes four IP addresses currently serving LONGLEASH command traffic. These addresses communicate via three ports, 99, 2222, and 8088, with the multi-port design allowing the malware to fall back to an alternative port if one is blocked at the perimeter. The infrastructure resolves to hosting providers across multiple jurisdictions, consistent with the ORB network pattern of distributing relay capacity across geographically dispersed nodes to complicate takedown operations.

Snort signatures are available for immediate deployment. SIDs 66430, 66431, 66432, 66433, and 301493 cover LONGLEASH and DOGLEASH traffic patterns at the packet level. ClamAV coverage includes 10 signatures across MIPS, ARM, and x64 architectures, addressing the router chipset diversity that UAT-7810 targets. Network defenders should prioritize deploying these signatures at perimeter inspection points where router management traffic crosses into the enterprise network.

Behavioral hunting indicators include unusual multi-protocol traffic from network devices, ICMP volume spikes from routers that should only generate management protocol traffic, and SMTP connections originating from network infrastructure. A router sending or receiving SMTP traffic is a near-certain indicator of LONGLEASH compromise, as SMTP is one of LONGLEASH's built-in relay modes and has no legitimate function on a standard enterprise router.

UAT-7810 does not target organizations directly for data theft. The group targets the network perimeter devices of any organization operating unpatched Ruckus or ASUS routers connected to the internet. Once compromised, those devices become relay nodes that serve other Chinese APT groups conducting targeted espionage. Any organization with unpatched network infrastructure may be unknowingly hosting a component of a Chinese state espionage operation, even if that organization is not itself a high-value intelligence target.

The highest-risk organizations are those with internet-facing Ruckus RuckOS devices that have not received patches addressing CVE-2020-22653, CVE-2020-22658, or CVE-2023-25717. Ruckus issued patches for the 2020 CVEs years ago, but adoption remains incomplete across SMB deployments and legacy campus network installations. The ASUS AiCloud vulnerability CVE-2025-2492 is more recent, but AiCloud deployments in manufacturing and remote-work environments are often managed by teams without a formal vulnerability management program.

The secondary threat actors using LapDogs relay capacity have historically targeted critical infrastructure, government agencies, and defense contractors. Organizations in those sectors face a compounded risk: their own perimeter devices may be compromised by UAT-7810 to serve as ORB nodes, and the same relay network is actively routing attacks against their sector peers.

Detection of UAT-7810 LONGLEASH activity requires looking at both endpoint indicators on network devices and behavioral network patterns. DOGLEASH's passive listener architecture generates no outbound traffic until an operator connects, so standard egress monitoring alone is insufficient. Defenders need inbound traffic inspection on router management interfaces combined with anomaly detection on ICMP and DNS volumes.

Cisco Talos Snort signatures (SIDs 66430-66433 and 301493) are the most direct detection mechanism. These signatures identify LONGLEASH command traffic patterns and DOGLEASH communication sequences at the packet level. Deploying these signatures at border inspection points on traffic crossing from the perimeter router segment into the enterprise network will surface active relay activity.

For threat hunting, query your SIEM for historical connections to the four confirmed C2 IPs over any time window: 194.233.92.26, 217.15.160.247, 217.15.164.147, and 95.182.100.231. Any connection from a network device to these addresses should be treated as a confirmed compromise requiring immediate incident response. LONGLEASH's SMTP functionality is particularly anomalous and easy to detect: query for SMTP traffic originating from router management IP addresses across your entire historical log archive.