TLDR Tech / InfoSec
UAT-7810 Continues Building ORB Networks Using New Malware
Cisco Talos assessed with high confidence that UAT-7810, a China-nexus actor maintaining the LapDogs ORB network, compromised unpatched Ruckus wireless routers to deploy a shell script that opened firewall access and launched its passive backdoor DOGLEASH. The group was found actively developing LONGLEASH, an expanded successor to its SHORTLEASH backdoor built on Boost.Asio with reverse-shell, multi-protocol proxying, and self-removal capabilities, alongside a new JAVA-based administrative backdoor, JARLEASH, configured with Simplified Chinese comments. Defenders operating Ruckus or ASUS AiCloud infrastructure should prioritize patching the referenced CVEs and apply relevant IoCs.
Read the full story