UAT-7810 China-Nexus ORB Network Expansion and Malware

UAT-7810, a China-nexus threat actor, is actively proliferating the 'LapDogs' Operational Relay Box (ORB) network to provide relay infrastructure for other secondary actors like UAT-5918. This campaign primarily targets internet-facing networking and SOHO devices, specifically unpatched Ruckus and ASUS routers, to proxy traffic and evade detection by mimicking legitimate local infrastructure.

The threat actor has significantly evolved its toolkit, moving from the previously known 'SHORTLEASH' to a more advanced version dubbed 'LONGLEASH.' This new modular framework supports complex proxying, encrypted communications via MbedTLS, and self-removal capabilities. Additionally, new tools such as the Linux-based DOGLEASH backdoor and the Java-based JARLEASH administrative tool have been observed, indicating a highly methodical approach to infrastructure management and global expansion across the United States and Southeast Asia.