UAT-7810 China-Nexus APT Expands LapDogs ORB Network

UAT-7810 is a China-nexus advanced persistent threat (APT) actor specializing in the creation and maintenance of Operational Relay Box (ORB) networks, primarily the 'LapDogs' infrastructure. This actor functions as an infrastructure-as-a-service provider for other Chinese state-sponsored groups, such as UAT-5918, allowing them to anonymize their attacks by routing traffic through compromised edge devices like routers.

Technically, the group has evolved its toolkit from the previously known SHORTLEASH implant to a more sophisticated successor named LONGLEASH, alongside new backdoors DOGLEASH (C-based) and JARLEASH (Java-based). They primarily target unpatched Ruckus and ASUS AiCloud routers using known vulnerabilities to establish persistent proxy nodes across global infrastructure.

This activity represents a significant threat to attribution and defensive monitoring. By leveraging a distributed network of compromised IoT and networking hardware, UAT-7810 provides downstream actors with a resilient and obscured launchpad for espionage operations, complicating the detection of the true origin of malicious traffic.