UAT 7810 transforms routers into ORB a network of relay nodes that amplifies attacks

Cisco Talos has revealed a significant evolution in the tools of a Chinese actor traced as UAT-7810 whose function seems to be to build and maintain a network of "Operational Relay Boxes" (ORB) - a deliberate infrastructure to serve as relief and concealment points for secondary operators carrying out targeted attacks. This tactic converts network devices exposed to the Internet into nodes reusable by multiple groups, which increases the operational risk of any organization that depends on unpatched edge equipment.

The striking thing is not only the persistence of the actor, but the investment in a continuous development cycle: ShortLeash, its original backdoor, has given way to LONGLEASH, a platform with expanded proxy and relay functions, capable of operating on multiple protocols (HTTP, DNS, SOCKS, TCP, ICMP, UDP), authorizing customers and self-destroying if you detect manipulation. At the same time, auxiliary tools such as DOGLEASH (a passive backdoor running shellcode in Linux), LEASHTEST (an ELF binary for MIPS platform testing) and JARLEASH (a Java backdoor for file and service management) have been observed. These pieces together show a systematic approach to compromise and stabilize access to network link doors and embedded devices.

The technical implications are clear: transforming routers and embossed boxes into anonymous "jumps" amplifies the impact of any actor who has access to these nodes. An ORB not only facilitates the replacement of commands and the exfiltration of data, but also complicates attribution and containment, because malicious traffic may appear to have originated from legitimate third parties that were previously compromised. In addition, attention to MIPS platforms and ELF binaries evidence that authors seek to maintain and expand the network by attacking teams that many organizations forget in their security inventory.

The vectors operated by UAT-7810 are not experimental: researchers have linked campaigns to known vulnerabilities in Ruckus routers and other devices, including CVE-2020-22653 and CVE-2023-25717, among others. This reinforces an uncomfortable truth for defenders: attackers continue to exploit failures published years ago in teams that remain exposed to the Internet or that do not receive updates for supplier obsolescence policies. Technical information on these vulnerabilities can be found on public bases such as NVD: CVE-2020-22653 and CVE-2023-25717. For additional context and analysis on infrastructure campaigns, the reader can review the publications of Cisco Talos on his official blog: Cisco Talos Blog.

From the point of view of national risks and critical infrastructure, the re-use of ORB by secondary actors with various motivations is serious: groups interested in sabotage, espionage or interruption can rent or reuse these nodes to achieve sensitive objectives with less likelihood of detection. The use of this infrastructure by other actors linked to attacks on critical infrastructure entities has already been documented, suggesting a criminal and possibly sponsored ecosystem operating on that technical basis.

For network organizations and administrators, the first line of defence is urgent and concrete: identify and park exposed devices, especially routers and embedded systems that provide Internet administration interfaces. If a patch is not available by the obsolescence of the equipment, the device should be removed from the public exposure or compensation applied such as IP access controls, edge-level filters and VPNs for remote management. In addition, it is crucial to audit inventories to detect embedded MIPS or Linux equipment that are often outside traditional patch management processes.

Detection requires specific approaches: monitoring unusual outgoing connections, especially proxy traffic through atypical protocols (e.g. ICMP tunneling or DNS over unusual patterns), record and analyse access to web services hosted on edge devices, and monitor the emergence of unauthorized processes or JARS. Safety equipment should integrate network traffic telemetry with device logs and intrusion detection systems to catch relief behavior and comand--characteristic ORB response. Preparing response playbooks that include node isolation and forensic rescue is also a priority.

For public infrastructure providers and operators, there is an additional responsibility: to communicate, correct and, where appropriate, replace equipment that cannot get updates. Providers should provide clear guides to mitigate remote exploitation and work with CERTs and the community to distribute indicators and mitigation. The smaller organizations should request their ISPs or network administrators to verify that domestic routers or OEM are not being used without the security settings needed for remote administration.

Finally, the technical evolution of actors like UAT- 7810 - their ability to develop, test on restricted platforms and deploy multiple malware families - suggests a sustained threat that will not disappear with a timely measure. The defence strategy must be comprehensive and persistent: asset management, patches, network segmentation, in-depth detection and coordination with suppliers and authorities. Keeping informed through threat intelligence sources and applying practical lessons is what will reduce the effectiveness of ORB networks and better protect critical organizations and services.

If you need technical guidance applied to your network or a specific risk analysis for your edge devices, early coordination with your security team, your supplier and the country's incident response teams can make the difference between an effective mitigation and a long-term gap.