UAT-7810, a China-nexus hacking group, is expanding a global network of hijacked internet devices by exploiting security flaws in Ruckus wireless routers and rolling out new custom malware.
This activity feeds into what researchers call an Operational Relay Box network, a chain of compromised devices used to hide the true origin of cyberattacks.
The tactic lets attackers route their traffic through ordinary home and business routers, making malicious activity blend in with normal internet traffic.
The group’s efforts are not new. Security researchers first flagged this ORB network, known as LapDogs, back in 2025, but the infrastructure has kept growing since then.
UAT-7810 appears to specialize in building and maintaining these relay networks so that other threat actors can use them to launch attacks on valuable targets. This division of labor makes it harder for defenders to trace an intrusion back to its true source.
Analysts from Cisco Talos said in a report shared with Cyber Security News (CSN) that they are actively tracking the infrastructure and malware tied to UAT-7810, describing the group as an advanced persistent threat responsible for sustaining the LapDogs network.
Talos also found that UAT-7810 shares some tools with another China-linked group, UAT-5918, though the two are tracked as separate actors with their own goals.
The attackers rely heavily on unpatched Ruckus routers to gain their initial foothold, exploiting known but unaddressed vulnerabilities rather than discovering new ones.
This approach shows that outdated firmware remains one of the easiest paths into a home or office network. Once inside, the group deploys an expanding toolkit of custom backdoors designed to keep control over compromised devices for the long term.
At the center of this campaign is a backdoor called SHORTLEASH, which Talos says is being replaced by an upgraded version named LONGLEASH that adds far more capability.
LONGLEASH can act as a proxy, run its own web server, manage encrypted tunnels, and even function as an intermediate command server that passes instructions along to other infected devices.
It borrows code from open-source libraries and uses a Chrome browser identifier to disguise its network traffic as normal web browsing.
Talos also uncovered two previously unseen tools, DOGLEASH and JARLEASH, alongside a small testing program called LEASHTEST.
DOGLEASH is a lightweight backdoor that listens quietly on infected Linux devices and waits for specific commands, such as running shell code or reading files.
JARLEASH, written in Java, gives the attackers a file management console and file transfer tools, and its configuration file contains comments written in Simplified Chinese.
Ruckus wireless routers have become a favored target because many units in the field still run outdated software, according to the report.
Talos identified three known vulnerabilities that UAT-7810 has exploited to break into these devices since 2025.
Once compromised, a router can be silently folded into the ORB network and used to relay traffic for months without the owner noticing.
The group has also shown interest in expanding beyond routers, with one server tied to the campaign used to target ASUS AiCloud devices earlier this year.
This suggests UAT-7810 is not limiting itself to a single vendor or device type as it grows its relay infrastructure.
Applying router firmware updates promptly and replacing end-of-life hardware are simple but effective steps that can close off this entry point.
Organizations and everyday users alike are encouraged to check whether their routers are still receiving security updates from the manufacturer.
Segmenting home and office networks so that a compromised router cannot easily reach other devices adds another layer of protection.
Since these attacks rely on quiet, long-term access rather than immediate damage, regular monitoring of network traffic for unusual connections is also worthwhile.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOC Teams.
Microsoft has pushed out an emergency, out-of-band Windows 11 update after its September Patch Tuesday…
CDR is the runtime, real-time half of cloud security: while CSPM tells you what’s misconfigured,…
Your SaaS estate M365, Salesforce, Workday, Slack, hundreds of others is a sprawl of misconfigurations,…
DSPM finds sensitive data you didn’t know you had, classifies it, maps who can reach…
Open-source packages are meant to save developers time. In the GemStuffer campaign, that trust became…
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…