China-Linked ORB Network Exploits Unpatched Routers to Build Persistent Attack Infrastructure
Written by AI from the linked story. Not reviewed by an editor. How this works
UAT-7810 is actively exploiting known vulnerabilities in internet-facing networking devices—specifically Ruckus and ASUS AiCloud routers—to build a sprawling Operational Relay Box (ORB) network used to proxy attacks against critical infrastructure. The root cause is a failure to apply timely patches to perimeter devices that are directly exposed to the internet, creating easy entry points for sophisticated threat actors. Once compromised, these devices serve as persistent relay nodes, enabling secondary threat actors to conduct further intrusions while obscuring the true origin of attacks. This matters because compromised networking infrastructure is extremely difficult to detect and remediate, and can persist unnoticed for months while facilitating espionage and destructive operations against critical sectors.
Tactical Insight
Immediate actions
- Audit all internet-facing networking devices (routers, access points, firewalls) and apply vendor-released patches immediately, prioritizing Ruckus and ASUS AiCloud devices.
- Disable remote management interfaces (web UI, SSH, Telnet) on perimeter devices unless strictly required, and restrict access via allowlisted IPs.
- Perform a threat hunt across edge devices for indicators of compromise associated with LONGLEASH, DOGLEASH, LEASHTEST, and JARLEASH malware families.
Long-term improvements
- Maintain a complete, continuously updated inventory of all network appliances, including firmware versions, to enable rapid identification of vulnerable assets.
- Implement a formal patch management lifecycle with SLA-based timelines (e.g., critical CVEs patched within 24–72 hours) specifically for internet-facing infrastructure.
- Enforce network segmentation so that compromised edge devices cannot be leveraged to pivot laterally into core infrastructure or OT/ICS environments.
Detection measures
- Deploy network traffic analysis tools to detect anomalous outbound connections or relay-style traffic patterns indicative of ORB node activity.
- Enable centralized syslog collection and integrity monitoring for all perimeter devices, alerting on unexpected configuration changes or new process execution.
- Subscribe to threat intelligence feeds and vendor security advisories to receive early warning of actively exploited vulnerabilities in networking equipment.