uat-7810

Executive Summary

UAT‑7810 is a China‑aligned advanced persistent threat that has expanded its Operational Relay Box (ORB) network and developed a family of cross‑platform backdoors. The group actively exploits known vulnerabilities in unpatched Ruckus wireless routers to gain initial access, then deploys custom malware such as LONGLEASH and DOGLEASH across MIPS, ARM, and x64 devices to facilitate lateral movement and provide intermediary command‑and‑control for other actors. Its operations target government, critical infrastructure, industrial, and commercial sectors in China, the UAE, Japan, and beyond.

Goals & Targeting

The strategic objective of UAT‑7810 appears two‑fold: first, to establish a resilient, distributed network of compromised networking equipment that can serve as an intermediary C&C hub; second, to leverage this infrastructure for financial exploitation against high‑value targets across multiple sectors. The actor deliberately selects devices that are widely deployed yet often unpatched—particularly Ruckus wireless routers—to maximize the reach and longevity of its foothold while remaining covert. By supporting secondary threat actors through the ORB network, UAT‑7810 increases the overall effectiveness and scale of campaigns with minimal operational risk. Its targeting profile focuses on government entities, critical infrastructure such as power and telecommunications, manufacturing facilities, oil and gas platforms, retail chains, construction enterprises, and related support services. These sectors provide both high potential financial returns (e.g., ransomware or data theft) and strategic influence. The geographic focus spans primarily the People's Republic of China, the United Arab Emirates, and Japan—regions where governmental and industrial networks are often interconnected with legacy Ruckus and ASUS AiCloud devices. Overall UAT‑7810 pursues missions that enhance its command‑control capabilities while injecting monetary value via ransomware, data exfiltration, or strategic sabotage.

Key Capabilities

• Build and maintain Operational Relay Box (ORB) networks
• Develop custom backdoors: LONGLEASH, SHORTLEASH, DOGLEASH, JARLEASH, LEASHTEST
• Deploy malware across MIPS, ARM, and x64 platforms
• Exploit unpatched Ruckus wireless routers using CVE‑2020‑22653, CVE‑2020‑22658, CVE‑2023‑25717, CVE‑2025‑2492
• Use shell scripts to download and execute payloads
• Transfer files via FTP/SFTP/Netcat
• Test functionality on MIPS devices with LEASHTEST
• Host custom malware: NetDraft/NosyDoor, CloudSorcerer, SNAPPYBEE/DeedRAT, ZingDoor, Draculoader
• Employ reverse shells and multi‑hop proxies to relay traffic through ORBs
• Serve as intermediate C&C server for secondary threat actors

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UAT‑7810 has demonstrated a consistent pattern of expanding its ORB network on a recurring schedule. The actor launches new backdoor variants—most recently LONGLEASH and DOGLEASH—while simultaneously exploiting publicly disclosed router vulnerabilities to broaden its foothold across diverse hardware ecosystems. Operational tempo appears moderate, with infrastructure updates (new C&C IPs, additional malware uploads) observed roughly every few weeks. Victims tend to be in sectors where network devices are ubiquitous yet under‑managed: government agencies, critical utilities, and large industrial sites. The attacker’s multi‑tiered approach (device exploitation → backdoor insertion → traffic relaying) allows for persistent access while masking their presence. Notable past operations include the compromise of multiple Ruckus Air‑Max routers in Asia-Pacific installations, followed by the injection of a custom backdoor that acted as a pivot to more valuable corporate targets. Recent indicators also suggest that UAT‑7810 has begun embedding its ORB infrastructure within supply‑chain environments, potentially extending its reach beyond direct device exploitation.

IOC Patterns

• CVE identifier
• IP address (IPv4)
• SHA-256 hash
• File name
• Domain name

Recommended Actions

• Patch all network devices to remediate CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492 before exploitation occurs.
• Block IP addresses identified as malicious payload hosts such as 217.15.164.147 and 95.182.100.231 at perimeter firewalls or DNS sinkholes.
• Implement active monitoring of startup scripts and suspicious binaries (e.g., DOGLEASH, JARLEASH) on all endpoints using baselines and behavior analytics.
• Segment corporate networks to isolate critical infrastructure from consumer‑grade device segments, limiting lateral movement via the ORB network.
• Deploy intrusion detection and prevention systems with signatures for known backdoor binaries and C&C traffic patterns, including multi‑hop proxy activity.
• Regularly audit firmware versions on Ruckus wireless routers and ASUS AiCloud devices, ensuring timely updates;
• Enforce strict firewall rules to block unauthorized outbound application layer protocols (e.g., DNS tunneling, SMTP exfiltration) often used by these actors.
• Educate security teams on Indicators of Compromise specific to UAT‑7810’s toolset, such as LEASHTEST execution on MIPS devices.

Suggested Tags