A hacking group tracked as UAT-7810 is actively expanding a global relay network by infecting networking gear — mostly unpatched Ruckus routers — with a growing malware toolkit.
Cisco Talos researchers published the details. The group’s goal is to build out what’s called an Operational Relay Box (ORB) network. Think of it as a proxy infrastructure: traffic bounces through compromised devices around the world, making it look like it’s coming from legitimate local IPs. That helps other Chinese-linked APT groups hide their tracks.
The centerpiece is LONGLEASH, an upgraded version of the SHORTLEASH backdoor first documented by SecurityScorecard in 2025. It does a lot more than its predecessor. Reverse shells. HTTP, DNS, SOCKS, TCP, ICMP, and UDP proxying. SMTP server and client functions. TLS and PKI support. It can even delete itself if it detects tampering.
Then there’s DOGLEASH, a lightweight Linux backdoor that opens a TCP port, authenticates with a hardcoded password, and lets attackers run shell commands or execute code directly in memory. JARLEASH is a Java admin tool with FTP, SFTP, and Netcat capabilities. LEASHTEST tests whether MIPS IoT devices can handle the malware operations.
The initial access vector is predictable. The group exploits known vulnerabilities — n-day stuff, not zero-days. CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers. CVE-2025-2492 in ASUS AiCloud routers. All have patches available. The devices just aren’t updated.
The bottom line: if you’ve got a Ruckus or ASUS router on your network and haven’t patched it in the last few years, you’re the target.
