Home › Threat Actors › UAT-7810
← All Threat Actors
Cybercrime high China (PRC)

UAT-7810

China-nexus (Cisco Talos); Talos considers UAT-7810 and UAT-5918 separate APT actors and says UAT-7810 was "most likely tasked" with building ORB networks · Operational Relay Box (ORB) network building, most likely in support of Chinese cyber operations

Reports 1
Active Since At least September 2023 per SecurityScorecard (LapDogs growth in waves); Talos gives no date
Last Reported 9 Jul 2026
Sectors Targeted critical-infrastructure, communications, government, finance

Tactics, Techniques & Procedures (TTPs)

  • Exploitation of n-day router flaws: Ruckus CVE-2020-22653, CVE-2020-22658 and CVE-2023-25717; ASUS AiCloud CVE-2025-2492 (exploited in early 2026)
  • SHORTLEASH and its successor LONGLEASH: proxy/tunnel/C2 implants, with LONGLEASH including an SMTP client and server (Boost.Asio, Nanopb, MbedTLS and musl components suggest C/C++; the language is not stated by Talos)
  • DOGLEASH: passive C-based backdoor with command execution, file operations and in-memory code execution
  • JARLEASH: Java backdoor with a web file manager and FTP/SFTP/netcat servers
  • LEASHTEST: benign MIPS test binary that likely indicates compromise
  • Payloads hosted on VPS for MIPS, ARM and x64; shell scripts add iptables rules; non-standard ports 8088, 2222 and 99 (TLS on 99); spoofed Windows Chrome 122 user-agent; implant self-removes when tampering is detected
  • Infrastructure pivot: SecurityScorecard found three new servers via a "CN=exploit" TLS certificate (93.113.99[.]48, 95.182.100[.]21, 83.172.159[.]10; Jan–Apr 2026)

Known Targets

SOHO and edge routers: Ruckus wireless routers and access points, ASUS AiCloud routers, Buffalo AirStation routersSecurityScorecard (2025): over 1,000 ShortLeash nodes, concentrated in the US and Southeast Asia (Japan, South Korea, Hong Kong, Taiwan)Talos names no victim countries or sectors and no customer other than UAT-5918

Analyst Notes

Disclosed by Cisco Talos on 7 July 2026, with SecurityScorecard research on the LapDogs network. CORRECTED against Talos: earlier text called LONGLEASH Go-based, said DOGLEASH collects credentials and JARLEASH does lateral movement and relay provisioning, called UAT-5918 a "confirmed customer" and said UAT-7810 works "exclusively" on ORBs, and listed government and critical-infrastructure targets via UAT-5918; none of these appear in the Talos post and they were removed or softened. Talos lists no ATT&CK IDs; those below are the site's own mapping.

Also Known As

LapDogs (SecurityScorecard name for the network)ff-agent (internal name of the shared SHORTLEASH/LONGLEASH codebase)nz1.0 (LONGLEASH internal name)iot-test (LEASHTEST internal name)

MITRE ATT&CK Techniques

T1584.008 Compromise Infrastructure: Network Devices (SOHO router compromise) T1090.002 Proxy: External Proxy (ORB network relay) T1572 Protocol Tunneling (relay infrastructure) T1199 Trusted Relationship (access provision to UAT-5918 and other clients) T1190 Exploit Public-Facing Application

Intelligence Reports

Analysis critical-infrastructurecommunications

UAT-7810 and LapDogs: Inside China's Malware Factory for Covert Relay Infrastructure

Cisco Talos has published detailed research on UAT-7810's LapDogs campaign: a China-nexus operation building Operational Relay Box networks through compromised SOHO routers. New malware families LONGLEASH, DOGLEASH, and JARLEASH reveal how far this infrastructure-as-a-service model has matured.

9 Jul 2026 · 14 min read