UAT-7810 Expands ORB Network With LONGLEASH and Related Tools
Summary
Cisco Talos reports that UAT-7810 targets exposed routers, particularly unpatched Ruckus devices, to expand its ORB network. Researchers detail LONGLEASH’s proxy and relay capabilities and three other tools used in the campaign.
Key points
- Cisco Talos says UAT-7810 compromises internet-facing routers, primarily unpatched Ruckus devices, to expand its Operational Relay Box infrastructure.
- The ORB network proxies traffic through regional devices, helping conceal its origin and complicate attribution; the article says it also serves other China-aligned APTs, including UAT-5918.
- Talos identified LONGLEASH, an upgraded version of SHORTLEASH, with reverse-shell, multi-protocol proxying, SMTP, TLS/PKI, self-removal, and intermediate C2 capabilities.
- DOGLEASH is a Linux backdoor deployed through web shell scripts; it supports shell commands, file operations, system information retrieval, and in-memory code execution.
- JARLEASH provides web-based file management and FTP, SFTP, and Netcat server functions; LEASHTEST checks malware-related capabilities on MIPS IoT devices.
- The report says UAT-7810 exploits known vulnerabilities in Ruckus and ASUS AiCloud routers, including CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492.
Article Details
- Attack Vectors
- UAT-7810 exploits known vulnerabilities in internet-facing Ruckus routers (CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717) and ASUS AiCloud routers (CVE-2025-2492) to gain access.
- DOGLEASH is deployed via web shell scripts and can execute shell commands and arbitrary code in host memory.
- Compromised networking devices are used as relay infrastructure to proxy traffic through regional systems.
- Defensive Notes
- Prioritize patching exposed Ruckus and ASUS AiCloud routers affected by the vulnerabilities cited in the report.
- Review internet-facing networking devices for compromise and unauthorized proxy or relay activity.
MITRE ATT&CK
T1059.004 · Unix ShellDOGLEASH supports shell command execution on compromised Linux hosts.T1090 · ProxyThe group uses compromised regional devices to proxy traffic, and LONGLEASH supports proxying multiple protocols.T1190 · Exploit Public-Facing ApplicationUAT-7810 reportedly exploits known vulnerabilities in internet-facing Ruckus and ASUS AiCloud routers to gain access.T1572 · Protocol TunnelingLONGLEASH supports network tunnel management and can proxy traffic across HTTP, DNS, SOCKS, TCP, ICMP, and UDP.
CVE
CVE-2020-22653Ruckuswireless · R310 firmware; Ruckuswireless · R500 firmware; +12 morethat UAT-7810 primarily exploits known (n-day) vulnerabilities to gain initial access, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers, as well as CVE-2025-2492 in ASUS AiCloudCVE-2020-22658Ruckuswireless · R310 firmware; Ruckuswireless · R500 firmware; +12 moreprimarily exploits known (n-day) vulnerabilities to gain initial access, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers, as well as CVE-2025-2492 in ASUS AiCloud routers.CVE-2023-25717Commscope · Ruckus smartzone firmware; Ruckuswireless · Ruckus wireless admin; +1 moreknown (n-day) vulnerabilities to gain initial access, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers, as well as CVE-2025-2492 in ASUS AiCloud routers.CVE-2025-2492Vendor / Product unavailableaccess, including CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers, as well as CVE-2025-2492 in ASUS AiCloud routers.
Threat Actors
Malware
DogLeashCisco Talos found new tools in the campaign, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST, alongside exploitation of multiple router vulnerabilities.LongLeashCisco Talos found new tools in the campaign, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST, alongside exploitation of multiple router vulnerabilities.ShortLeash#UAT-7810
Vendors
Products
Tools
JARLEASHCisco Talos found new tools in the campaign, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST, alongside exploitation of multiple router vulnerabilities.LEASHTESTCisco Talos found new tools in the campaign, including LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST, alongside exploitation of multiple router vulnerabilities.