Winning 54% of the time

Cisco Talos has identified activity from the China-nexus threat actor UAT-7810, which is expanding its Operational Relay Box (ORB) networks using custom malware to exploit vulnerabilities in unpatched Ruckus and ASUS routers. The group has deployed updated backdoors, including LONGLEASH and DOGLEASH, to create covert proxy infrastructure used by other APT groups. This infrastructure enables threat actors to mask their origins and bypass traditional defenses by routing traffic through compromised edge devices.

AI-extracted · verify before operational use