UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and JARLEASH Malware Suite (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, CVE-2025-2492)
UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and (TL-2026-1257), also tracked as LapDogs ORB Network Expansion, is a high-severity malware campaign scored CVSS 9.8, first published 2026-07-13 and last reviewed 2026-09-05. It is attributed to UAT-7810 (China) with high confidence, affects Ruckus Ruckus Wireless Admin / Wireless Access Points, references 4 CVEs (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717), maps to 32 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-1257
- Threat ID
- TL-2026-1257
- Also known as
- LapDogs ORB Network Expansion
- Severity
- HIGH
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-13
- Last reviewed
- 2026-09-05
- Attribution
- UAT-7810
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, critical-infrastructure, telecoms, consumer-networking
- Target regions
- taiwan, Global
- Detection rules
- 9
- Indicators of compromise
- 29
- Updates
- 2026-09-05 · revalidated 1× · latest source
Malware and tooling in UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and
Malware and tooling: DOGLEASH, JARLEASH, LEASHTEST, LONGLEASH, ShortLeash (ELF)
China-nexus APT actor UAT-7810 continues building Operational Relay Box (ORB) networks — including the long-running LapDogs ORB — for use by secondary Chinese threat actors such as UAT-5918, compromising unpatched Ruckus wireless routers and ASUS AiCloud devices via known n-day CVEs. Talos documents a growing malware suite (LONGLEASH, SHORTLEASH, DOGLEASH, JARLEASH, LEASHTEST) providing backdoor, proxying, tunneling, and intermediate-C2 relay capabilities across MIPS, ARM, and x64 embedded/IoT architectures.
How UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and works
UAT-7810 is a China-nexus threat actor assessed to operate as an infrastructure provider — building and maintaining Operational Relay Box (ORB) networks that are subsequently leveraged by other China-aligned APT groups, notably UAT-5918, to proxy attack traffic against high-value targets (including Taiwanese critical infrastructure) while evading attribution. The group maintains the long-running LapDogs ORB network, first disclosed in 2025, and continues to expand it by compromising internet-facing, unpatched embedded network devices.
Initial access is achieved by exploiting n-day vulnerabilities in Ruckus wireless Access Point/router firmware (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 — an unauthenticated RCE via crafted HTTP GET request in Ruckus Wireless Admin through 10.4, CVSS 9.8) and, as of early 2026, ASUS AiCloud routers (CVE-2025-2492 — an improper authentication control / CWE-288 flaw allowing remote, unauthenticated bypass of AiCloud authentication, CVSS 9.2). Post-exploitation, the actor deploys shell scripts that configure iptables rules and then download and execute the group's custom malware.
The malware arsenal has expanded significantly since the original SHORTLEASH backdoor. LONGLEASH (Talos-observed internal build name 'nz1.0') is a next-generation rewrite built on the SHORTLEASH codebase using the Boost.Asio library for asynchronous networking; it adds reverse shell functionality, HTTP/DNS/SOCKS/TCP/ICMP/UDP proxying and packet redirection, SMTP client/server capability, TLS/PKI integration, self-deletion on detection of suspicious analysis activity, and the ability to act as an intermediate C2 relay node between compromised devices and downstream operators. DOGLEASH is a newly-identified C-based passive backdoor for Linux that listens on a hardcoded port, uses password-based command decoding, spawns a thread per received command, supports remote command execution via /bin/sh, file read/backup operations, OS/hardware fingerprinting, and in-memory shellcode execution; it has been cross-compiled for MIPS, MIPS32r2, ARMv7, MIPS1, MIPS32r2el, and MIPS32el architectures, reflecting the broad range of embedded router/IoT hardware targeted. JARLEASH is a newly-identified Java-based (JAR) backdoor deployed for hands-on administrative access on at least one C2 server, providing a web-based file manager, FTP/SFTP server hosting, and Netcat server deployment; JARLEASH kills existing malware instances before spawning new processes, and its configuration files contain Simplified Chinese-language comments, reinforcing Chinese-speaking operator attribution. LEASHTEST is a non-malicious ELF test binary for the MIPS platform used to validate thread creation/joining, TCP port binding, process spawning, async timers, and exception handling prior to full malware deployment — its presence on a device is itself an indicator of compromise and shows UAT-7810 is still actively validating tooling on MIPS-based embedded targets.
UAT-7810 operates at least four attacker-controlled C2/hosting servers (194.233.92.26, 217.15.160.247, 217.15.164.147, and 95.182.100.231 — the last geolocated to Hong Kong), each exposing consistent ports 2222, 8088, and 99, used for DOGLEASH C2 hosting and TLS-terminated communications. The infrastructure shares a distinctive self-signed TLS certificate with subject/issuer fields deliberately set to the literal string 'exploit' across all DN fields (C=exploit, ST=exploit, L=exploit, O=exploit, OU=exploit, CN=exploit) — a notable operational fingerprint. 217.15.164.147 was specifically observed being used for the ASUS AiCloud (CVE-2025-2492) exploitation activity. Malware samples masquerade network traffic using a browser user-agent string and encode payloads with Base58/Base64 and Protocol Buffer (protobuf) serialization; the toolset relies on Boost.Asio, Nanopb, MbedTLS, and musl libc.
Talos assesses UAT-7810's role as most likely that of an ORB infrastructure provider tasked with building relay networks leveraged by associated secondary Chinese threat actors — including UAT-5918, which specifically targets Taiwanese critical infrastructure — to conduct further intrusions while obscuring the true origin of attack traffic behind compromised, legitimate-looking regional consumer/SOHO network devices. Talos published five Snort SIDs (66430, 66431, 66432, 66433, 301493) and ten ClamAV signatures covering the LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST families across multiple CPU architectures, indicating active, ongoing tracking of this cluster.
MITRE ATT&CK techniques used in TL-2026-1257
Collection
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1562.004 Impair Defenses; T1601.001 Modify System Image; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.004 Unix Shell; T1106 Native API
Command and Control
T1071.001 Web Protocols; T1071.002 Application Layer Protocol; T1071.003 Mail Protocols; T1071.004 DNS; T1090.002 External Proxy; T1090.003 Multi-hop Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505 Server Software Component
persistence
Resource Development
T1583.004 Server; T1584.005 Botnet; T1584.008 Compromise Infrastructure; T1587.001 Malware
defense-impairment
Affected products and versions in UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and
- Ruckus — Ruckus Wireless Admin / Wireless Access Points
Vulnerable versions: through 10.4
Fixed in: vendor patch addressing CVE-2023-25717 - Ruckus — Ruckus Wireless Routers/APs (CVE-2020-22653, CVE-2020-22658)
Vulnerable versions: affected firmware pre-patch
Fixed in: vendor patch - ASUS — AiCloud-enabled routers
Vulnerable versions: 3.0.0.4_382; 3.0.0.4_386; 3.0.0.4_388; 3.0.0.6_102
Fixed in: updated firmware released April 2026 by ASUS
Remediation for UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and
Patches
- Ruckus: apply vendor firmware patch remediating CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus Wireless Admin
- ASUS: update AiCloud-enabled router firmware beyond vulnerable series 3.0.0.4_382, 3.0.0.4_386, 3.0.0.4_388, 3.0.0.6_102 to remediate CVE-2025-2492
Immediate actions
- Block all identified C2 IPs at network perimeter: 194.233.92.26, 217.15.160.247, 217.15.164.147, 95.182.100.231
- Block outbound traffic to ports 2222, 8088, and 99 on the above IPs
- Hunt for the self-signed TLS certificate fingerprint c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15 (Subject/Issuer DN fields all set to 'exploit') in TLS inspection logs
- Deploy the published Snort SIDs (66430, 66431, 66432, 66433, 301493) and ClamAV signatures on perimeter IDS/IPS and endpoint AV covering router/embedded devices
- Identify and isolate any Ruckus wireless AP/router or ASUS AiCloud-enabled router exposed to the internet
Workarounds
- Disable AiCloud service on ASUS routers if patching is not immediately possible
- Restrict Ruckus Wireless Admin management interface to trusted internal networks only, disabling internet-facing exposure
- Place vulnerable embedded devices behind a firewall / VPN gateway to eliminate direct internet reachability
Longer-term hardening
- Inventory all SOHO/embedded network devices (routers, IoT) for internet-facing management interfaces and remove unnecessary exposure
- Establish a firmware patch management program for edge network devices
- Deploy network traffic analysis capable of detecting SOCKS/TCP/UDP/ICMP proxy tunneling anomalies from consumer-grade network devices
- Monitor for LEASHTEST-style test-binary artifacts as early indicators of pre-deployment staging on embedded devices
CVEs associated with UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and
CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, CVE-2025-2492
Weaknesses (CWE) in UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and
CWE-288, CWE-78, CWE-306, CWE-347, CWE-494, CWE-94
Timeline of UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and
- Security researcher publicly documents the Ruckus firmware image-signature verification bypass flaws later tracked as CVE-2020-22653 and CVE-2020-22658.
- CVE-2023-25717, an unauthenticated Ruckus Wireless Admin RCE vulnerability (CVSS 9.8), publicly disclosed.
- Fortinet telemetry observes an exploitation spike for CVE-2023-25717 against internet-facing Ruckus Wireless Admin devices.
- CVE-2023-25717 (Ruckus Wireless Admin unauthenticated RCE) is added to the CISA Known Exploited Vulnerabilities (KEV) catalog.
- LapDogs ORB network, later attributed to UAT-7810, first publicly disclosed by SecurityScorecard research along with the original SHORTLEASH backdoor.
- ASUS discloses and patches CVE-2025-2492, a critical (CVSS 9.2) AiCloud authentication bypass vulnerability affecting multiple router firmware series.
- SecurityScorecard's STRIKE team publicly discloses the LapDogs ORB network and its ShortLeash backdoor, reporting over 1,000 compromised Linux-based SOHO devices — the precise disclosure date for the network's original 2025 exposure.
- UAT-7810 begins exploiting CVE-2025-2492 against unpatched ASUS AiCloud routers to expand the ORB network into early 2026, using server 217.15.164.147 for this activity.
- Talos observes UAT-7810 actively developing and testing the LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST malware families across MIPS, ARM, and x64 architectures on attacker-controlled infrastructure.
- Coverage of the Talos findings republished by The Hacker News, BleepingComputer, Infosecurity Magazine, and other outlets, amplifying detection guidance.
- Cisco Talos publishes 'UAT-7810 continues building ORB networks using new malware,' detailing the expanded malware suite, C2 infrastructure, and detection signatures (Snort SIDs, ClamAV signatures).
- QuoIntelligence references the UAT-7810 disclosure in its Week 28 2026 Weekly Threat Intelligence Snapshot.
- TL-Intel Harness ingests and documents TL-2026-1257 based on Talos reporting and cross-referenced CVE/vendor advisory data.
Update history for TL-2026-1257
- 2026-09-05 — China-Linked UAT-7810 Expands LapDogs ORB Network With New LONGLEASH Backdoor and Router Exploits: What changed No change to severity_level, exploitability, status, or cvss_score — all remain HIGH/ACTIVE/ACTIVE/9.8 as already published. Declined to adopt the new report's CRITICAL severity relabeling (same CVSS 9.8, same already-ACTIVE ex
Sources cited for UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and
- UAT-7810 continues building ORB networks using new malware
- Malpedia: UAT-7810 library entry
- China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
- Chinese hackers develop LONGLEASH malware to expand ORB network
- China-Linked APT Expands Proxy Network With New Malware
- LONGLEASH Malware Adds Reverse Shell, Proxying, and Intermediate C2 Capabilities
- CVE-2025-2492 Detail - NVD
- CVE-2023-25717 Detail - NVD
- ASUS Confirms Critical Flaw in AiCloud Routers; Users Urged to Update Firmware
- ASUS warns of critical auth bypass flaw in routers using AiCloud
- Exploitation Spike Observed for Ruckus Wireless Admin RCE Vulnerability CVE-2023-25717
- CVE-2023-25717 : Ruckus Wireless Admin Remote Code Execution
More in malware
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant
- Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
Detection coverage for TL-2026-1257
As of 2026-09-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1257 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1257
7 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.