UAT-7810 Expands Malware Arsenal with New Tools and Techniques
Talos Intelligence has assessed with high confidence that UAT-7810 is a China-nexus threat actor, providing infrastructure to other China-linked APTs, including UAT-5918. Despite some overlap in tools, Talos considers these two groups distinct in their objectives. Recent findings indicate that UAT-7810 is actively developing its custom malware, notably an updated version of SHORTLEASH called LONGLEASH, which is hosted on attacker-controlled infrastructure.
UAT-7810 has introduced two new tools: DOGLEASH, a backdoor that listens for incoming requests on a hardcoded port, and JARLEASH, a JAVA-based backdoor designed for easy access to compromised systems. The actor has also utilized at least four new servers to host various iterations of DOGLEASH, targeting systems with known vulnerabilities, particularly in unpatched Ruckus wireless routers.
The malware hosted by UAT-7810 includes DOGLEASH, which executes shell scripts on compromised systems to download and run malicious payloads. Notably, UAT-7810 has exploited vulnerabilities such as CVE-2025-2492 in ASUS AiCloud Routers, indicating an effort to broaden its operational network.
LONGLEASH, built on the same codebase as SHORTLEASH, features enhanced capabilities, including acting as an intermediate command and control (C2) server. It utilizes the Boost.Asio library to optimize network performance and includes components for managing network connections and client authorizations. The implant disguises itself within legitimate traffic, using a User-Agent string that mimics a common web browser.
In addition to LONGLEASH, UAT-7810 has developed LEASHTEST, a non-malicious binary used for testing functionality on MIPS platforms, suggesting ongoing development and confidence testing of their malware on various hardware. The presence of comments in Simplified Chinese within JARLEASH's configuration file further indicates the operators' linguistic background.
Talos has provided SNORT® SIDs and ClamAV signatures for the identified threats, enabling organizations to enhance their defenses against these evolving malware tools.
