# UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and JARLEASH Malware Suite (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, CVE-2025-2492)

> China-nexus APT actor UAT-7810 continues building Operational Relay Box (ORB) networks — including the long-running LapDogs ORB — for use by secondary Chinese threat actors such as UAT-5918, compromising unpatched Ruckus wireless routers and ASUS AiCloud devices via known n-day CVEs. Talos documents a growing malware suite (LONGLEASH, SHORTLEASH, DOGLEASH, JARLEASH, LEASHTEST) providing backdoor, proxying, tunneling, and intermediate-C2 relay capabilities across MIPS, ARM, and x64 embedded/IoT architectures.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-09-05T14:59:20.219Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1257
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-uat-7810-longleash-orb-relays-tl-2026-1257.webp?v=6d89a5d9 (Threadlinqs threat intel: UAT-7810 LONGLEASH and DOGLEASH: Detection & IOCs (TL-2026-1257) — High severity, 29 IOCs, 9 detection rules.)
- **ID:** TL-2026-1257
- **Severity:** HIGH (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAT-7810 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)
- **CVEs:** CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, CVE-2025-2492

## Description

UAT-7810 is a China-nexus threat actor assessed to operate as an infrastructure provider — building and maintaining Operational Relay Box (ORB) networks that are subsequently leveraged by other China-aligned APT groups, notably UAT-5918, to proxy attack traffic against high-value targets (including Taiwanese critical infrastructure) while evading attribution. The group maintains the long-running LapDogs ORB network, first disclosed in 2025, and continues to expand it by compromising internet-facing, unpatched embedded network devices.

Initial access is achieved by exploiting n-day vulnerabilities in Ruckus wireless Access Point/router firmware (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717 — an unauthenticated RCE via crafted HTTP GET request in Ruckus Wireless Admin through 10.4, CVSS 9.8) and, as of early 2026, ASUS AiCloud routers (CVE-2025-2492 — an improper authentication control / CWE-288 flaw allowing remote, unauthenticated bypass of AiCloud authentication, CVSS 9.2). Post-exploitation, the actor deploys shell scripts that configure iptables rules and then download and execute the group's custom malware.

The malware arsenal has expanded significantly since the original SHORTLEASH backdoor. LONGLEASH (Talos-observed internal build name 'nz1.0') is a next-generation rewrite built on the SHORTLEASH codebase using the Boost.Asio library for asynchronous networking; it adds reverse shell functionality, HTTP/DNS/SOCKS/TCP/ICMP/UDP proxying and packet redirection, SMTP client/server capability, TLS/PKI integration, self-deletion on detection of suspicious analysis activity, and the ability to act as an intermediate C2 relay node between compromised devices and downstream operators. DOGLEASH is a newly-identified C-based passive backdoor for Linux that listens on a hardcoded port, uses password-based command decoding, spawns a thread per received command, supports remote command execution via /bin/sh, file read/backup operations, OS/hardware fingerprinting, and in-memory shellcode execution; it has been cross-compiled for MIPS, MIPS32r2, ARMv7, MIPS1, MIPS32r2el, and MIPS32el architectures, reflecting the broad range of embedded router/IoT hardware targeted. JARLEASH is a newly-identified Java-based (JAR) backdoor deployed for hands-on administrative access on at least one C2 server, providing a web-based file manager, FTP/SFTP server hosting, and Netcat server deployment; JARLEASH kills existing malware instances before spawning new processes, and its configuration files contain Simplified Chinese-language comments, reinforcing Chinese-speaking operator attribution. LEASHTEST is a non-malicious ELF test binary for the MIPS platform used to validate thread creation/joining, TCP port binding, process spawning, async timers, and exception handling prior to full malware deployment — its presence on a device is itself an indicator of compromise and shows UAT-7810 is still actively validating tooling on MIPS-based embedded targets.

UAT-7810 operates at least four attacker-controlled C2/hosting servers (194.233.92.26, 217.15.160.247, 217.15.164.147, and 95.182.100.231 — the last geolocated to Hong Kong), each exposing consistent ports 2222, 8088, and 99, used for DOGLEASH C2 hosting and TLS-terminated communications. The infrastructure shares a distinctive self-signed TLS certificate with subject/issuer fields deliberately set to the literal string 'exploit' across all DN fields (C=exploit, ST=exploit, L=exploit, O=exploit, OU=exploit, CN=exploit) — a notable operational fingerprint. 217.15.164.147 was specifically observed being used for the ASUS AiCloud (CVE-2025-2492) exploitation activity. Malware samples masquerade network traffic using a browser user-agent string and encode payloads with Base58/Base64 and Protocol Buffer (protobuf) serialization; the toolset relies on Boost.Asio, Nanopb, MbedTLS, and musl libc.

Talos assesses UAT-7810's role as most likely that of an ORB infrastructure provider tasked with building relay networks leveraged by associated secondary Chinese threat actors — including UAT-5918, which specifically targets Taiwanese critical infrastructure — to conduct further intrusions while obscuring the true origin of attack traffic behind compromised, legitimate-looking regional consumer/SOHO network devices. Talos published five Snort SIDs (66430, 66431, 66432, 66433, 301493) and ten ClamAV signatures covering the LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST families across multiple CPU architectures, indicating active, ongoing tracking of this cluster.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1587.001 Malware
- T1583.004 Server
- T1584.005 Botnet
- T1059.004 Unix Shell
- T1106 Native API
- T1505 Server Software Component
- T1070.004 File Deletion
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1505.003 Web Shell
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1071.004 DNS
- T1071.003 Mail Protocols
- T1090.003 Multi-hop Proxy
- T1090.002 External Proxy
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1573.002 Asymmetric Cryptography
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1584.008 Compromise Infrastructure
- T1601.001 Modify System Image
- T1036 Masquerading
- T1562.004 Impair Defenses
- T1071.002 Application Layer Protocol
- T1571 Non-Standard Port

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**UAT-7810 ORB C2 Beaconing — Multi-Port Cluster to Known Infrastructure with Spoofed Browser UA** (`TL-2026-1257-SPL-003`)

Detects outbound connections to the four known UAT-7810 C2/hosting IPs (194.233.92.26, 217.15.160.247, 217.15.164.147, 95.182.100.231) on the consistent port set 2222/8088/99, optionally carrying the spoofed Chrome/122.0.6261.95 User-Agent string used to masquerade LONGLEASH/DOGLEASH C2 traffic as legitimate browser traffic.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1090.002, T1090.003
- **Data sources:** pan:traffic, cisco:asa, web_proxy, CommonSecurityLog
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="pan:traffic" OR sourcetype="cisco:asa" OR sourcetype="web_proxy"
| eval dest_port=coalesce(dest_port, dst_port)
| where dest_ip IN ("194.233.92.26", "217.15.160.247", "217.15.164.147", "95.182.100.231") AND dest_port IN (2222, 8088, 99)
| eval ua_match=if(match(http_user_agent, "Chrome/122\.0\.6261\.95"), 1, 0)
| stats count values(dest_port) as ports max(ua_match) as spoofed_ua_seen by src_ip, dest_ip
| where count >= 1
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in ("194.233.92.26", "217.15.160.247", "217.15.164.147", "95.182.100.231")
| where DestinationPort in (2222, 8088, 99)
| extend SpoofedUA = iff(RequestUserAgent has "Chrome/122.0.6261.95", true, false)
| summarize ConnCount = count(), Ports = make_set(DestinationPort), AnySpoofedUA = max(SpoofedUA) by SourceIP, DestinationIP
```

### Sigma

```yaml
title: UAT-7810 ORB Beaconing to Known C2 Infrastructure with Spoofed Browser UA
id: 3f1e0c1a-1257-4c3a-9b7e-uat7810-orb-beacon
status: experimental
description: Detects outbound network connections to UAT-7810's known C2/hosting IP set on the consistent 2222/8088/99 port pattern, optionally carrying the reported spoofed Chrome User-Agent string.
references:
    - https://blog.talosintelligence.com/uat-7810/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/13
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1090.002
    - attack.t1090.003
logsource:
    category: proxy
    product: windows
detection:
    selection_ip:
        cs-host:
            - '194.233.92.26'
            - '217.15.160.247'
            - '217.15.164.147'
            - '95.182.100.231'
        cs-uri-port:
            - 2222
            - 8088
            - 99
    selection_ua:
        c-useragent|contains: 'Chrome/122.0.6261.95'
    condition: selection_ip or selection_ua
falsepositives:
    - None expected for the IP-based selection; the User-Agent selection alone may match legitimate Chrome 122.0.6261.95 browser traffic and should be combined with the IP match for high confidence
level: critical
```

**Known false positives:**

- None expected for IP-based matches; User-Agent-only matches without the known C2 IP could reflect legitimate Chrome 122.0.6261.95 traffic

**Tuning notes:** Keep the C2 IP list current via the Talos IOC feed; treat User-Agent-only matches as low-confidence unless paired with the IP or port selection.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Post-Exploitation Shell Script Deployment via iptables Staging (UAT-7810) (locked: unlock with TL Creds)
- OS/Hardware Fingerprinting and Local File Collection Post-Compromise (DOGLEASH) (locked: unlock with TL Creds)
- Self-Signed TLS Certificate with 'exploit' DN Fields — UAT-7810 C2 Fingerprint (locked: unlock with TL Creds)
- LEASHTEST MIPS Test Binary / DOGLEASH Cross-Architecture Payload Drop (locked: unlock with TL Creds)
- JARLEASH Java Backdoor — Ad-Hoc Web File Manager / FTP / Netcat Deployment (locked: unlock with TL Creds)
- LONGLEASH Ingress Tool Transfer Followed by Rapid Self-Deletion (Anti-Analysis) (locked: unlock with TL Creds)
- Ruckus Wireless Admin / ASUS AiCloud Unauthenticated Exploitation Attempt (CVE-2023-25717 / CVE-2025-2492) (locked: unlock with TL Creds)
- DOGLEASH-style Passive Listener on Hardcoded High Port with Password-Gated Command Dispatch (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `194.233.92[.]26`
- IP address: `217.15.160[.]247`
- IP address: `217.15.164[.]147`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [UAT-7810 continues building ORB networks using new malware](https://blog.talosintelligence.com/uat-7810/)
- [Malpedia: UAT-7810 library entry](https://malpedia.caad.fkie.fraunhofer.de/library/dcb60819-1051-4a35-833b-f7009dd5d2a4/)
- [China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware](https://thehackernews.com/2026/07/china-linked-uat-7810-expands-orb.html)
- [Chinese hackers develop LONGLEASH malware to expand ORB network](https://www.bleepingcomputer.com/news/security/chinese-hackers-develop-longleash-malware-to-expand-orb-network/)
- [China-Linked APT Expands Proxy Network With New Malware](https://www.infosecurity-magazine.com/news/uat-7810-china-apt-orb-proxy/)
- [LONGLEASH Malware Adds Reverse Shell, Proxying, and Intermediate C2 Capabilities](https://gbhackers.com/longleash-malware-attack/amp/)
- [CVE-2025-2492 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-2492)
- [CVE-2023-25717 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2023-25717)
- [ASUS Confirms Critical Flaw in AiCloud Routers; Users Urged to Update Firmware](https://thehackernews.com/2025/04/asus-confirms-critical-flaw-in-aicloud.html)
- [ASUS warns of critical auth bypass flaw in routers using AiCloud](https://www.bleepingcomputer.com/news/security/asus-warns-of-critical-auth-bypass-flaw-in-routers-using-aicloud/)
- [Exploitation Spike Observed for Ruckus Wireless Admin RCE Vulnerability CVE-2023-25717](https://www.fortiguard.com/threat-signal-report/5151/exploitation-spike-observed-for-ruckus-wireless-admin-rce-vulnerability-cve-2023-25717)
- [CVE-2023-25717 : Ruckus Wireless Admin Remote Code Execution](https://www.cvedetails.com/cve/CVE-2023-25717/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1257