A China-linked APT group has been building out its toolset, adding three new backdoors to an already active espionage campaign.
Cisco’s Talos researchers are tracking the group as UAT-7810. They’ve been watching it for a while through a campaign called LapDogs, where the APT infected over 1,000 SOHO routers with an older backdoor called ShortLeash. Now the group’s got more options.
The new additions:
LongLeash — an updated version of ShortLeash built on the same codebase but with added libraries (Nanopb, MbedTLS). It can act as an intermediate server, forwarding commands between C&C servers and other infected peers.
DogLeash — a C-based passive backdoor deployed via shell script. It adds iptables rules and listens on a TCP port. Depending on what the C&C sends, it can execute commands, read or rename files, pull OS info, and run code in memory.
JarLeash — a Java-based backdoor for easy access. It can host a web-based file management interface, FTP and SFTP servers, and run a netcat server on any provided IP and port.
The group mainly targets known vulnerabilities in Ruckus wireless routers — specifically CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717. They’re using payloads for MIPS, ARM, and x64 architectures.
Talos also found UAT-7810 developing something called LeashTest, a non-malicious binary used to test functionality on MIPS platforms. It’s not dangerous on its own, but it’s a useful indicator of compromise.
UAT-7810 provides infrastructure to another China-linked APT, UAT-5918. Their tooling overlaps, but Talos keeps them separate for now.
One of the IPs Talos identified was also used in attacks against Asus AiCloud Routers as part of Operation WrtHug, which hit over 50,000 devices in 2025.
