China-Linked UAT-7810 Adds Three Backdoors to LapDogs Arsenal
Summary
Talos details UAT-7810’s LongLeash, DogLeash, and JarLeash backdoors, their capabilities and deployment, and infrastructure linked to the LapDogs espionage campaign targeting routers.
Key points
- Talos tracks the China-linked actor as UAT-7810 and its espionage infrastructure campaign as LapDogs; SecurityScorecard previously reported that the campaign infected more than 1,000 SOHO routers with ShortLeash.
- UAT-7810 targets known Ruckus wireless router vulnerabilities CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, with payloads for MIPS, ARM, and x64.
- LongLeash, a newer ShortLeash version, supports command-and-control communication, web hosting, and tunnel management, and can forward commands and data between peers.
- DogLeash is a C-based passive backdoor deployed by shell script; it can execute commands and code in memory, read and rename files, and retrieve operating-system information.
- JarLeash is a Java-based backdoor that can provide file management and run FTP, SFTP, and netcat servers.
- Talos identified payload-hosting infrastructure associated with UAT-7810. One IP was also used in attacks targeting Asus AiCloud routers, likely as part of Operation WrtHug.
- LeashTest is a MIPS functionality-testing binary that Talos says is not malicious by itself but may serve as an indicator of compromise.
Article Details
- Attack Vectors
- UAT-7810 targets known vulnerabilities in Ruckus wireless routers, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717.
- The campaign infects SOHO routers with backdoors and uses payloads for MIPS, ARM, and x64 architectures.
- DogLeash is deployed via a shell script that adds iptables rules to allow TCP traffic to its listening port.
- Defensive Notes
- Talos says LeashTest is not malicious on its own, but its presence can be an indicator of compromise.
MITRE ATT&CK
T1005 · Data from Local SystemDogLeash can read files on compromised systems.T1059 · Command and Scripting InterpreterDogLeash executes commands based on code received from its C&C; it is deployed via a shell script.T1082 · System Information DiscoveryDogLeash can retrieve operating-system information from compromised systems.T1090 · ProxyLongLeash can act as an intermediate server, forwarding commands and data received from the C&C to other peers.T1105 · Ingress Tool TransferUAT-7810 uses VPS instances to download payloads and servers to host malicious payloads and shell scripts.T1190 · Exploit Public-Facing ApplicationUAT-7810 targets known vulnerabilities in Ruckus wireless routers to compromise them.T1572 · Protocol TunnelingLongLeash supports tunnel management and can forward commands and data between its C&C and other peers.
CVE
CVE-2020-22653Ruckuswireless · R310 firmware; Ruckuswireless · R500 firmware; +12 moreUAT-7810 mainly targets known vulnerabilities in Ruckus wireless routers, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, and was seen using payloads for multiple architectures, including MIPS, ARM, andCVE-2020-22658Ruckuswireless · R310 firmware; Ruckuswireless · R500 firmware; +12 moreUAT-7810 mainly targets known vulnerabilities in Ruckus wireless routers, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, and was seen using payloads for multiple architectures, including MIPS, ARM, andCVE-2023-25717Commscope · Ruckus smartzone firmware; Ruckuswireless · Ruckus wireless admin; +1 moreknown vulnerabilities in Ruckus wireless routers, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, and was seen using payloads for multiple architectures, including MIPS, ARM, and x64.
Threat Actors
UAT-5918The article identifies UAT-5918 as another China-linked APT that receives infrastructure from UAT-7810; the groups' tooling overlaps, but Talos tracks them separately.UAT-7810Talos tracks this China-linked APT as UAT-7810 and reports that it targets router vulnerabilities, deploys backdoors, and operates payload infrastructure as part of the LapDogs espionage campaign.
Malware
DogLeashTalos, which tracks the threat actor as UAT-7810, has discovered a newer version of the backdoor, dubbed LongLeash, as well as two other malware families the APT has been relying on, namely DogLeash and JarLeash.JarLeashTalos, which tracks the threat actor as UAT-7810, has discovered a newer version of the backdoor, dubbed LongLeash, as well as two other malware families the APT has been relying on, namely DogLeash and JarLeash.LongLeashTalos, which tracks the threat actor as UAT-7810, has discovered a newer version of the backdoor, dubbed LongLeash, as well as two other malware families the APT has been relying on, namely DogLeash and JarLeash.ShortLeashAs part of a prolonged espionage infrastructure campaign tracked as LapDogs, the APT infected over 1,000 small office/home office (SOHO) routers with the ShortLeash backdoor, SecurityScorecard reported last year.
Vendors
AsusOne of the IPs was also used in attacks targeting Asus AiCloud Routers, likely as part of the apparent ORB facilitation campaign dubbed Operation WrtHug that was publicly detailed in November 2025.RuckusUAT-7810 mainly targets known vulnerabilities in Ruckus wireless routers, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, and was seen using payloads for multiple architectures, including MIPS, ARM, and
Products
Asus AiCloud RoutersOne of the IPs was also used in attacks targeting Asus AiCloud Routers, likely as part of the apparent ORB facilitation campaign dubbed Operation WrtHug that was publicly detailed in November 2025.Ruckus wireless routersUAT-7810 mainly targets known vulnerabilities in Ruckus wireless routers, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, and was seen using payloads for multiple architectures, including MIPS, ARM, and