Threat Advisory • Attack Report • TA2026191

UAT-7810 Expands Its Arsenal with New LONGLEASH and DOGLEASH Malware

UAT-7810 is a China-nexus APT that builds and maintains an Operational Relay Box (ORB) network by hijacking internet-facing networking devices — primarily unpatched Ruckus wireless routers — through known n-day vulnerabilities, then deploying custom Linux malware to convert each device into a relay node used by other China-aligned threat actors to mask the origin of their own operations.

Section 01

Summary

UAT-7810 is a China-nexus advanced persistent threat first observed in 2025 that builds and maintains an Operational Relay Box (ORB) network, which other China-aligned actors then use to hide the origin of their own attacks. Targeting is worldwide, with the group breaking into internet-facing networking devices — mainly unpatched Ruckus wireless routers running Linux on embedded/IoT hardware (MIPS, ARM, x64) — by exploiting known (n-day) vulnerabilities rather than phishing or stolen credentials.

Once a device is compromised, UAT-7810 deploys custom Linux malware to turn it into a relay node in its wider ORB infrastructure. Its arsenal now includes five distinct tools: SHORTLEASH, the original backdoor; LONGLEASH, an upgraded, stealthier successor built on the same codebase; DOGLEASH, a passive backdoor that listens quietly on a chosen local port; LEASHTEST, a non-malicious testing utility used to validate MIPS-based device support; and JARLEASH, a Java-based administrative tool used to manage files and provide remote access on compromised servers. Together these tools let UAT-7810 recruit compromised Ruckus routers into an ORB network that other China-nexus operators, such as UAT-5918, can lean on to obscure the true source of their intrusions.

---

Section 02

Attack Details

#1 — Initial Access via N-Day Exploitation of Ruckus Routers

UAT-7810 gains its first foothold by targeting internet-facing networking hardware, primarily Ruckus wireless routers that have not been patched. Rather than relying on phishing or stolen credentials, the group weaponizes publicly known (n-day) vulnerabilities in these devices, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717. The last of these allows unauthenticated remote code execution through a crafted HTTP GET request, giving the attacker direct command execution on the device without any login. Activity observed earlier this year also reached into ASUS AiCloud routers vulnerable to CVE-2025-2492, suggesting the group is looking to broaden the range of hardware it can recruit into its relay network.

#2 — Deployment of DOGLEASH, LONGLEASH, and JARLEASH

Once a device is compromised, UAT-7810 runs a shell script that downloads its DOGLEASH backdoor from attacker-controlled servers, adds firewall (iptables) rules so inbound traffic can reach a chosen port, and then launches the malware. DOGLEASH sits quietly listening on that local port, decrypts incoming requests using a hardcoded password, and acts on command codes to run shell commands, read or back up files, gather operating-system details, or execute code directly in memory. On more capable devices the group deploys LONGLEASH, an upgraded version of its older SHORTLEASH backdoor that shares the same codebase (internally named "ff-agent"). LONGLEASH is built for stealth and performance, disguises its traffic with a fake Windows Chrome browser identifier, and will wipe itself and its traces from the device if it detects tampering. A Java-based administrative tool, JARLEASH, is also used on some servers to manage files and provide easy remote access.

#3 — Building the ORB Relay Network

UAT-7810's goal on each device is not to move deeper into a single victim network but to convert the device into a node in its wider ORB relay infrastructure. LONGLEASH can proxy and redirect traffic across HTTP, DNS, SOCKS, TCP, ICMP, and UDP, set up and manage network tunnels, and even act as an intermediate command-and-control server that relays instructions and data between the primary C2 and other infected nodes. By chaining compromised devices together this way, the group provides secondary China-nexus actors, such as UAT-5918, with regional infrastructure that makes their attacks appear to come from legitimate local systems and complicates attribution.

#4 — Encrypted Channels and File Staging

Because the compromised devices function as relay and tunneling points, data movement is handled through LONGLEASH's encrypted channels rather than a single smash-and-grab exfiltration step. The implant uses TLS with public-key infrastructure and x509 certificates (built on the MbedTLS library) to secure its communications, and the operators stood up TLS services on non-standard ports using a distinctive certificate. DOGLEASH's file-read and backup commands and JARLEASH's FTP, SFTP, and web-based file management give the operators direct ways to stage and retrieve files from a compromised host. The LEASHTEST utility, meanwhile, is a non-malicious test binary the group uses to confirm that MIPS-based devices can support the functions LONGLEASH needs, indicating the toolset is still under active development.

Exploited Ruckus Vulnerabilities

---

Section 03

Recommendations

---

Section 04

Potential MITRE ATT&CK TTPs

---

Section 05

Indicators of Compromise (IOCs)

---

Section 06

Patch Links & References

Patch Links

• https://support.ruckuswireless.com/security_bulletins/302
• https://support.ruckuswireless.com/security_bulletins/315

References

• https://blog.talosintelligence.com/uat-7810/