UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and JARLEASH Malware Suite (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, CVE-2025-2492)

Key facts for UAT-7810 LONGLEASH ORB relays

Detection coverage for UAT-7810 LONGLEASH ORB relays

As of 2026-09-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1257 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: UAT-7810 ORB C2 Beaconing — Multi-Port Cluster to Known Infrastructure with Spoofed Browser UA

Detects outbound connections to the four known UAT-7810 C2/hosting IPs (194.233.92.26, 217.15.160.247, 217.15.164.147, 95.182.100.231) on the consistent port set 2222/8088/99, optionally carrying the spoofed Chrome/122.0.6261.95 User-Agent string used to masquerade LONGLEASH/DOGLEASH C2 traffic as legitimate browser traffic.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1090.002, T1090.003
• Data sources: pan:traffic, cisco:asa, web_proxy, CommonSecurityLog
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="web_proxy"
| eval dest_port=coalesce(dest_port, dst_port)
| where dest_ip IN ("194.233.92.26", "217.15.160.247", "217.15.164.147", "95.182.100.231") AND dest_port IN (2222, 8088, 99)
| eval ua_match=if(match(http_user_agent, "Chrome/122\.0\.6261\.95"), 1, 0)
| stats count values(dest_port) as ports max(ua_match) as spoofed_ua_seen by src_ip, dest_ip
| where count >= 1

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in ("194.233.92.26", "217.15.160.247", "217.15.164.147", "95.182.100.231")
| where DestinationPort in (2222, 8088, 99)
| extend SpoofedUA = iff(RequestUserAgent has "Chrome/122.0.6261.95", true, false)
| summarize ConnCount = count(), Ports = make_set(DestinationPort), AnySpoofedUA = max(SpoofedUA) by SourceIP, DestinationIP

Sigma

title: UAT-7810 ORB Beaconing to Known C2 Infrastructure with Spoofed Browser UA
id: 3f1e0c1a-1257-4c3a-9b7e-uat7810-orb-beacon
status: experimental
description: Detects outbound network connections to UAT-7810's known C2/hosting IP set on the consistent 2222/8088/99 port pattern, optionally carrying the reported spoofed Chrome User-Agent string.
references:
    - https://blog.talosintelligence.com/uat-7810/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/13
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1090.002
    - attack.t1090.003
logsource:
    category: proxy
    product: windows
detection:
    selection_ip:
        cs-host:
            - '194.233.92.26'
            - '217.15.160.247'
            - '217.15.164.147'
            - '95.182.100.231'
        cs-uri-port:
            - 2222
            - 8088
            - 99
    selection_ua:
        c-useragent|contains: 'Chrome/122.0.6261.95'
    condition: selection_ip or selection_ua
falsepositives:
    - None expected for the IP-based selection; the User-Agent selection alone may match legitimate Chrome 122.0.6261.95 browser traffic and should be combined with the IP match for high confidence
level: critical

Known false positives:

• None expected for IP-based matches; User-Agent-only matches without the known C2 IP could reflect legitimate Chrome 122.0.6261.95 traffic

Tuning notes: Keep the C2 IP list current via the Talos IOC feed; treat User-Agent-only matches as low-confidence unless paired with the IP or port selection.

• 🔒 Post-Exploitation Shell Script Deployment via iptables Staging (UAT-7810) · unlock with TL Creds
• 🔒 OS/Hardware Fingerprinting and Local File Collection Post-Compromise (DOGLEASH) · unlock with TL Creds
• 🔒 Self-Signed TLS Certificate with 'exploit' DN Fields — UAT-7810 C2 Fingerprint · unlock with TL Creds
• 🔒 LEASHTEST MIPS Test Binary / DOGLEASH Cross-Architecture Payload Drop · unlock with TL Creds
• 🔒 JARLEASH Java Backdoor — Ad-Hoc Web File Manager / FTP / Netcat Deployment · unlock with TL Creds
• 🔒 LONGLEASH Ingress Tool Transfer Followed by Rapid Self-Deletion (Anti-Analysis) · unlock with TL Creds
• 🔒 Ruckus Wireless Admin / ASUS AiCloud Unauthenticated Exploitation Attempt (CVE-2023-25717 / CVE-2025-2492) · unlock with TL Creds
• 🔒 DOGLEASH-style Passive Listener on Hardcoded High Port with Password-Gated Command Dispatch · unlock with TL Creds

Indicators of compromise for UAT-7810 LONGLEASH ORB relays

As of 2026-09-05, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-1257.

Sample indicators (3 of 29)

• IP address: 194.233.92[.]26
• IP address: 217.15.160[.]247
• IP address: 217.15.164[.]147

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration for UAT-7810 LONGLEASH ORB relays

7 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How UAT-7810 LONGLEASH ORB relays works

Talos documents a growing malware suite (LONGLEASH, SHORTLEASH, DOGLEASH, JARLEASH, LEASHTEST) providing backdoor, proxying, tunneling, and intermediate-C2 relay capabilities across MIPS, ARM, and x64 embedded/IoT architectures.

UAT-7810 is a China-nexus threat actor assessed to operate as an infrastructure provider — building and maintaining Operational Relay Box (ORB) networks that are subsequently leveraged by other China-aligned APT groups, notably UAT-5918, to proxy attack traffic against high-value targets (including Taiwanese critical infrastructure) while evading attribution. The group maintains the long-running LapDogs ORB network, first disclosed in 2025, and continues to expand it by compromising internet-facing, unpatched embedded network devices.

Initial access is achieved by exploiting n-day vulnerabilities in Ruckus wireless Access Point/router firmware (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 — an unauthenticated RCE via crafted HTTP GET request in Ruckus Wireless Admin through 10.4, CVSS 9.8) and, as of early 2026, ASUS AiCloud routers (CVE-2025-2492 — an improper authentication control / CWE-288 flaw allowing remote, unauthenticated bypass of AiCloud authentication, CVSS 9.2). Post-exploitation, the actor deploys shell scripts that configure iptables rules and then download and execute the group's custom malware.

The malware arsenal has expanded significantly since the original SHORTLEASH backdoor. LONGLEASH (Talos-observed internal build name 'nz1.0') is a next-generation rewrite built on the SHORTLEASH codebase using the Boost.Asio library for asynchronous networking; it adds reverse shell functionality, HTTP/DNS/SOCKS/TCP/ICMP/UDP proxying and packet redirection, SMTP client/server capability, TLS/PKI integration, self-deletion on detection of suspicious analysis activity, and the ability to act as an intermediate C2 relay node between compromised devices and downstream operators. DOGLEASH is a newly-identified C-based passive backdoor for Linux that listens on a hardcoded port, uses password-based command decoding, spawns a thread per received command, supports remote command execution via /bin/sh, file read/backup operations, OS/hardware fingerprinting, and in-memory shellcode execution; it has been cross-compiled for MIPS, MIPS32r2, ARMv7, MIPS1, MIPS32r2el, and MIPS32el architectures, reflecting the broad range of embedded router/IoT hardware targeted. JARLEASH is a newly-identified Java-based (JAR) backdoor deployed for hands-on administrative access on at least one C2 server, providing a web-based file manager, FTP/SFTP server hosting, and Netcat server deployment; JARLEASH kills existing malware instances before spawning new processes, and its configuration files contain Simplified Chinese-language comments, reinforcing Chinese-speaking operator attribution. LEASHTEST is a non-malicious ELF test binary for the MIPS platform used to validate thread creation/joining, TCP port binding, process spawning, async timers, and exception handling prior to full malware deployment — its presence on a device is itself an indicator of compromise and shows UAT-7810 is still actively validating tooling on MIPS-based embedded targets.

UAT-7810 operates at least four attacker-controlled C2/hosting servers (194.233.92.26, 217.15.160.247, 217.15.164.147, and 95.182.100.231 — the last geolocated to Hong Kong), each exposing consistent ports 2222, 8088, and 99, used for DOGLEASH C2 hosting and TLS-terminated communications. The infrastructure shares a distinctive self-signed TLS certificate with subject/issuer fields deliberately set to the literal string 'exploit' across all DN fields (C=exploit, ST=exploit, L=exploit, O=exploit, OU=exploit, CN=exploit) — a notable operational fingerprint. 217.15.164.147 was specifically observed being used for the ASUS AiCloud (CVE-2025-2492) exploitation activity. Malware samples masquerade network traffic using a browser user-agent string and encode payloads with Base58/Base64 and Protocol Buffer (protobuf) serialization; the toolset relies on Boost.Asio, Nanopb, MbedTLS, and musl libc.

Talos assesses UAT-7810's role as most likely that of an ORB infrastructure provider tasked with building relay networks leveraged by associated secondary Chinese threat actors — including UAT-5918, which specifically targets Taiwanese critical infrastructure — to conduct further intrusions while obscuring the true origin of attack traffic behind compromised, legitimate-looking regional consumer/SOHO network devices. Talos published five Snort SIDs (66430, 66431, 66432, 66433, 301493) and ten ClamAV signatures covering the LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST families across multiple CPU architectures, indicating active, ongoing tracking of this cluster.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1562.004 Impair Defenses; T1601.001 Modify System Image; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell; T1106 Native API

Command and Control

T1071.001 Web Protocols; T1071.002 Application Layer Protocol; T1071.003 Mail Protocols; T1071.004 DNS; T1090.002 External Proxy; T1090.003 Multi-hop Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505 Server Software Component

persistence

T1505.003 Web Shell

Resource Development

T1583.004 Server; T1584.005 Botnet; T1584.008 Compromise Infrastructure; T1587.001 Malware

defense-impairment

T1685 Disable or Modify Tools

Remediation for UAT-7810 LONGLEASH ORB relays

Patches

• Ruckus: apply vendor firmware patch remediating CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus Wireless Admin
• ASUS: update AiCloud-enabled router firmware beyond vulnerable series 3.0.0.4_382, 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102 to remediate CVE-2025-2492

Immediate actions

• Block all identified C2 IPs at network perimeter: 194.233.92.26, 217.15.160.247, 217.15.164.147, 95.182.100.231
• Block outbound traffic to ports 2222, 8088, and 99 on the above IPs
• Hunt for the self-signed TLS certificate fingerprint c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15 (Subject/Issuer DN fields all set to 'exploit') in TLS inspection logs
• Deploy the published Snort SIDs (66430, 66431, 66432, 66433, 301493) and ClamAV signatures on perimeter IDS/IPS and endpoint AV covering router/embedded devices
• Identify and isolate any Ruckus wireless AP/router or ASUS AiCloud-enabled router exposed to the internet

Workarounds

• Disable AiCloud service on ASUS routers if patching is not immediately possible
• Restrict Ruckus Wireless Admin management interface to trusted internal networks only, disabling internet-facing exposure
• Place vulnerable embedded devices behind a firewall / VPN gateway to eliminate direct internet reachability

Longer-term hardening

• Inventory all SOHO/embedded network devices (routers, IoT) for internet-facing management interfaces and remove unnecessary exposure
• Establish a firmware patch management program for edge network devices
• Deploy network traffic analysis capable of detecting SOCKS/TCP/UDP/ICMP proxy tunneling anomalies from consumer-grade network devices
• Monitor for LEASHTEST-style test-binary artifacts as early indicators of pre-deployment staging on embedded devices

Affected and fixed versions

• Ruckus — Ruckus Wireless Admin / Wireless Access Points
  Vulnerable versions: through 10.4
  Fixed in: vendor patch addressing CVE-2023-25717
• Ruckus — Ruckus Wireless Routers/APs (CVE-2020-22653, CVE-2020-22658)
  Vulnerable versions: affected firmware pre-patch
  Fixed in: vendor patch
• ASUS — AiCloud-enabled routers
  Vulnerable versions: 3.0.0.4_382; 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102
  Fixed in: updated firmware released April 2026 by ASUS

Timeline of UAT-7810 LONGLEASH ORB relays

Last updated 2026-09-05 · revalidated 1× · latest source

• 2020-03-01 Security researcher publicly documents the Ruckus firmware image-signature verification bypass flaws later tracked as CVE-2020-22653 and CVE-2020-22658.
• 2023-03-01 CVE-2023-25717, an unauthenticated Ruckus Wireless Admin RCE vulnerability (CVSS 9.8), publicly disclosed.
• 2023-05-01 Fortinet telemetry observes an exploitation spike for CVE-2023-25717 against internet-facing Ruckus Wireless Admin devices.
• 2023-05-12 CVE-2023-25717 (Ruckus Wireless Admin unauthenticated RCE) is added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
• 2025-01-01 locked-ioc-18, later attributed to UAT-7810, first publicly disclosed by SecurityScorecard research along with the original locked-ioc-23 backdoor.
• 2025-04-28 ASUS discloses and patches CVE-2025-2492, a critical (CVSS 9.2) AiCloud authentication bypass vulnerability affecting multiple router firmware series.
• 2025-06-23 SecurityScorecard's STRIKE team publicly discloses the locked-ioc-18 and its locked-ioc-23 backdoor, reporting over 1,000 compromised Linux-based SOHO devices — the precise disclosure date for the network's original 2025 exposure.
• 2026-01-01 UAT-7810 begins exploiting CVE-2025-2492 against unpatched ASUS AiCloud routers to expand the ORB network into early 2026, using server locked-ioc-20 for this activity.
• 2026-06-01 Talos observes UAT-7810 actively developing and testing the locked-ioc-24, locked-ioc-26, locked-ioc-27, and locked-ioc-25 malware families across MIPS, ARM, and x64 architectures on attacker-controlled infrastructure.
• 2026-07-07 Coverage of the Talos findings republished by The Hacker News, BleepingComputer, Infosecurity Magazine, and other outlets, amplifying detection guidance.
• 2026-07-07 Cisco Talos publishes 'UAT-7810 continues building ORB networks using new malware,' detailing the expanded malware suite, C2 infrastructure, and detection signatures (Snort SIDs, ClamAV signatures).
• 2026-07-09 QuoIntelligence references the UAT-7810 disclosure in its Week 28 2026 Weekly Threat Intelligence Snapshot.
• 2026-07-13 TL-Intel Harness ingests and documents TL-2026-1257 based on Talos reporting and cross-referenced CVE/vendor advisory data.

Update history

• 2026-09-05 — China-Linked UAT-7810 Expands locked-ioc-18 With New locked-ioc-24 Backdoor and Router Exploits: What changed No change to severity_level, exploitability, status, or cvss_score — all remain HIGH/ACTIVE/ACTIVE/9.8 as already published. Declined to adopt the new report's CRITICAL severity relabeling (same CVSS 9.8, same already-ACTIVE ex

Sources cited for UAT-7810 LONGLEASH ORB relays

• CVE-2025-2492 Detail - NVD NVD (NIST) · Advisory · 2025-04-28
• CVE-2023-25717 Detail - NVD NVD (NIST) · Advisory · 2023-03-01
• CVE-2023-25717 : Ruckus Wireless Admin Remote Code Execution cvedetails.com · Advisory · 2023-03-01
• Malpedia: UAT-7810 library entry malpedia.caad.fkie.fraunhofer.de · Research · 2026-07-07
• Exploitation Spike Observed for Ruckus Wireless Admin RCE Vulnerability CVE-2023-25717 FortiGuard Labs · Vendor report · 2023-05-01
• UAT-7810 continues building ORB networks using new malware Cisco Talos · Blog · 2026-07-07
• China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware The Hacker News · News · 2026-07-07
• Chinese hackers develop LONGLEASH malware to expand ORB network BleepingComputer · News · 2026-07-07
• China-Linked APT Expands Proxy Network With New Malware infosecurity-magazine.com · News · 2026-07-07
• LONGLEASH Malware Adds Reverse Shell, Proxying, and Intermediate C2 Capabilities gbhackers.com · News · 2026-07-07
• ASUS Confirms Critical Flaw in AiCloud Routers; Users Urged to Update Firmware The Hacker News · News · 2025-04-28
• ASUS warns of critical auth bypass flaw in routers using AiCloud BleepingComputer · News · 2025-04-28

More in malware

• NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control
• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)

Previous and next in malware

• SnakeKeylogger Infostealer Delivered via Phishing Emails Disguised as Project Proposals (ASEC, JS→PowerShell Fileless Loader) Previous report
• Armored Likho APT (Eagle Werewolf) Deploys AI-Generated Loaders to Drop BusySnake Python Stealer Against Government and Power-Sector Targets Next report