[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnl7xii8Yrho2N70UTtdHEiuEtp7Qa0bp-Hp4kQ0VVxo":3},{"article":4,"iocs":54,"watch_terms":81,"solutions":82,"lesson":173},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"ee933441-648a-484d-a456-d286cba6e40f","China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware","china-linked-uat-7810-expands-orb-network-with-new-longleash-malware-b00083","A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by breaking into internet-facing networking devices. According to findings from Cisco Talos, UAT-7810 is an advanced persistent threat (APT) actor that's responsible for maintaining and proliferating LapDogs, an ORB network that first came to light in June 2025.","Chinese threat actor UAT-7810 is actively developing and deploying new malware variants—including LONGLEASH, DOGLEASH, LEASHTEST, and JARLEASH—to expand its Operational Relay Box (ORB) network called LapDogs. The group targets internet-facing networking devices, particularly Ruckus wireless routers and ASUS AiCloud routers, exploiting known vulnerabilities to establish persistent infrastructure for secondary threat actors like UAT-5918 to conduct attacks on critical infrastructure in Taiwan and beyond.","Chinese APT UAT-7810 deploys LONGLEASH malware to expand ORB botnet targeting routers","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fchina-linked-uat-7810-expands-orb.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhXpYmSnXODMABymw2qCiVS3p13OIwfJ45yIZq-o8wXfgtWXxOPjPbsGjdgEExUsWcvkKhtyPBhGsc6mSIzg8fzwrVJE_GIIm0k3qbzMd7BSjUcAjRFznnsXjv-dnG-Zq671G-_PYcHe88J4yTpy0FBc_pReVfNVrwGvGceEvAbLqA_roMRNI2DjbwohEqK\u002Fs1600\u002Frouters.jpg","2026-07-08T09:04:33+00:00","2026-07-08T10:00:23.925859+00:00",9,[17,20,22,25,28,31],{"name":18,"type":19},"UAT-7810","threat_actor",{"name":21,"type":19},"UAT-5918",{"name":23,"type":24},"LapDogs","campaign",{"name":26,"type":27},"Cisco","vendor",{"name":29,"type":30},"Ruckus Wireless Routers","product",{"name":32,"type":30},"ASUS AiCloud Routers","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,61,64,67,70,74,76,78],{"type":43,"value":56,"context":57},"ShortLeash","Predecessor backdoor malware with C2 and web server capabilities",{"type":43,"value":59,"context":60},"LONGLEASH","Updated backdoor framework with enhanced proxying and C2 relay functionality",{"type":43,"value":62,"context":63},"DOGLEASH","Passive Linux backdoor for arbitrary shellcode execution",{"type":43,"value":65,"context":66},"LEASHTEST","ELF binary testing tool for MIPS-based embedded devices",{"type":43,"value":68,"context":69},"JARLEASH","Java-based JAR backdoor for administration, file management, and FTP\u002FSFTP",{"type":71,"value":72,"context":73},"cve","CVE-2020-22653","Ruckus wireless router vulnerability exploited by UAT-7810",{"type":71,"value":75,"context":73},"CVE-2020-22658",{"type":71,"value":77,"context":73},"CVE-2023-25717",{"type":71,"value":79,"context":80},"CVE-2025-2492","ASUS AiCloud Router vulnerability targeted in 2026 campaigns",[26,29,32],{"controls":83,"vendors":167},[84,113,138],{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":114,"name":115,"problem":116,"products":117},"patch-management","Automated patch management","Known holes get closed in days, not months.",[118,122,130],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":114,"product_name":119,"url":120,"description":121},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":139,"name":140,"problem":141,"products":142},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[143,151,159],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[168],{"slug":169,"name":26,"logo_path":170,"roles":171},"cisco","\u002Fvendor-logos\u002Fcisco.png",[172],"reported_by",{"slug":174,"title":175,"body":176,"framework_refs":177,"framework_notes":193},"china-linked-orb-network-exploits-unpatched-routers-to-build-persistent-attack-infrastructure","China-Linked ORB Network Exploits Unpatched Routers to Build Persistent Attack Infrastructure","UAT-7810 is actively exploiting known vulnerabilities in internet-facing networking devices—specifically Ruckus and ASUS AiCloud routers—to build a sprawling Operational Relay Box (ORB) network used to proxy attacks against critical infrastructure. The root cause is a failure to apply timely patches to perimeter devices that are directly exposed to the internet, creating easy entry points for sophisticated threat actors. Once compromised, these devices serve as persistent relay nodes, enabling secondary threat actors to conduct further intrusions while obscuring the true origin of attacks. This matters because compromised networking infrastructure is extremely difficult to detect and remediate, and can persist unnoticed for months while facilitating espionage and destructive operations against critical sectors.",[178,179,180,181,182,183,184,185,186,187,188,189,190,191,192],"CIS Control 1: Inventory and Control of Enterprise Assets","CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST CSF ID.AM-1: Physical devices and systems are inventoried","NIST CSF PR.IP-12: A vulnerability management plan is developed and implemented","NIST SP 800-41: Guidelines on Firewalls and Firewall Policy","NIST AC-17: Remote Access Controls","NIST SI-2: Flaw Remediation","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1599: Network Boundary Bridging","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities","ITIL 4: Change Enablement (emergency change procedures for critical patches)",{}]