China-Linked APT UAT-7810 Expands Proxy Network with New Malware

A China-linked hacking group known as UAT-7810 has been expanding its network of hijacked devices, utilizing several newly discovered pieces of custom malware to enhance its operational capabilities. According to researchers from Cisco Talos, UAT-7810 is an advanced persistent threat (APT) group that has established what are known as Operational Relay Box (ORB) networks. These networks consist of compromised routers and other devices that are rented out to other hackers, allowing them to route their traffic through these devices and conceal their origins.

Talos has assessed with high confidence that UAT-7810 is a group with ties to China. The group has maintained a long-running ORB network referred to as LapDogs, which was first exposed in 2025. The primary function of this network is to build infrastructure that can be utilized by other cybercriminals. Once UAT-7810 has quietly taken control of enough devices, it enables separate China-linked APT groups to use this relay network to mask their espionage activities against high-value targets.

To expand its network, UAT-7810 has been exploiting known but unpatched vulnerabilities in edge devices, a tactic that relies on organizations failing to implement necessary security updates. The researchers noted that the group has targeted flaws in Ruckus wireless routers since 2025 and, more recently, began exploiting a vulnerability in ASUS routers to incorporate them into its network.

In addition to expanding its infrastructure, Talos reported that UAT-7810 is developing an upgraded backdoor named LONGLEASH. This new tool is an evolution of an earlier version and includes enhanced proxying features, allowing it to relay commands to other infected machines. The researchers also discovered two previously unknown backdoors: DOGLEASH, which executes commands on compromised Linux devices, and JARLEASH, a Java-based tool used for managing the group’s servers.

A configuration file for JARLEASH contained comments in Simplified Chinese, suggesting that Chinese-speaking operators are involved in the group’s activities. Furthermore, Talos found a test program aimed at MIPS-based devices, indicating that UAT-7810 is still refining its tools to accommodate the diverse hardware within its network. These findings are based on Talos's ongoing tracking of the group's malware and servers, which remain active.