China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware

A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by breaking into internet-facing networking devices. According to findings from Cisco Talos, UAT-7810 is an advanced persistent threat (APT) actor that's responsible for maintaining and proliferating LapDogs, an ORB network that first came to light in June 2025.

Cisco Talos reports that the China-linked APT UAT-7810 is expanding its LapDogs Operational Relay Box (ORB) network using a new malware family called LONGLEASH, an evolution of the SHORTLEASH backdoor, alongside DOGLEASH, JARLEASH, and related tooling.[1][3][6] The actor compromises internet-facing networking devices, particularly unpatched Ruckus and ASUS AiCloud routers, to build covert relay infrastructure likely used to support broader China-nexus espionage operations.[3][4][5] From a RealGround perspective, this highlights a critical AI supply chain risk: AI agents and data pipelines that depend on edge routers, VPNs, or cloud-access gateways can have their traffic proxied or manipulated through such ORB networks, undermining model integrity, telemetry, and incident-response visibility. Organizations should treat networking and IoT infrastructure as part of the AI supply chain, apply strict patching and SBOM-based vulnerability management, and monitor for ORB-like relay behavior to prevent covert access paths into AI environments.