UAT-7810

UAT-7810 is a China-nexus advanced persistent threat actor focused on building, maintaining, and expanding Operational Relay Box (ORB) infrastructure, most notably the LapDogs network. Rather than concentrating primarily on end-target intrusion objectives, the group appears to function as an infrastructure and initial-access provider for other China-aligned espionage actors, including UAT-5918, while remaining a distinct cluster despite tooling overlap. The actor specializes in compromising internet-facing networking and edge devices, especially unpatched Ruckus wireless routers, and has also been linked to exploitation of ASUS AiCloud router vulnerabilities. Its operations rely on known n-day vulnerabilities rather than publicly described zero-days. After compromise, UAT-7810 repurposes devices into relay nodes that proxy malicious traffic, obscure operator origin, and support downstream reconnaissance, command-and-control, malware delivery, and exfiltration activity by secondary actors. UAT-7810 maintains a bespoke malware ecosystem tailored to embedded and Linux-based environments across multiple architectures including MIPS, ARM, and x64. Associated malware families include SHORTLEASH and its successor LONGLEASH, the passive Linux backdoor DOGLEASH, the Java-based administrative backdoor JARLEASH, and the testing utility LEASHTEST. LONGLEASH extends earlier functionality with reverse shell access, multi-protocol proxying, packet redirection, tunnel management, intermediate command-and-control forwarding, SMTP functionality, TLS/PKI handling, client authorization, and self-removal when tampering is detected. DOGLEASH supports shellcode or command execution, file operations, and host information collection. JARLEASH provides web-based file management and file-transfer or listener capabilities useful for administration of compromised systems and actor-controlled servers. LEASHTEST is used to validate functionality on MIPS and IoT-class devices, reflecting ongoing development for heterogeneous router and embedded-device environments. Available attribution reporting assesses UAT-7810 with high confidence as a Chinese-speaking, China-aligned actor. Its role in sustaining renewable relay infrastructure makes it a significant enabler of broader Chinese espionage operations by helping affiliated actors blend malicious traffic with legitimate residential and small-business edge infrastructure and complicating attribution and blocking.