China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware

UAT-7810 is actively exploiting known vulnerabilities in internet-facing networking devices—specifically Ruckus and ASUS AiCloud routers—to build a sprawling Operational Relay Box (ORB) network used to proxy attacks against critical infrastructure. The root cause is a failure to apply timely patches to perimeter devices that are directly exposed to the internet, creating easy entry points for sophisticated threat actors. Once compromised, these devices serve as persistent relay nodes, enabling secondary threat actors to conduct further intrusions while obscuring the true origin of attacks. This matters because compromised networking infrastructure is extremely difficult to detect and remediate, and can persist unnoticed for months while facilitating espionage and destructive operations against critical sectors.