# UAT-7810 Expands LapDogs ORB Network via LONGLEASH Malware

> China-linked actor UAT-7810 is leveraging new LONGLEASH malware to expand the LapDogs ORB network, targeting internet-facing networking devices for proxying.

- Published: 2026-07-08T10:20:49.000Z
- Severity: medium
- Category: Threat Intel
- Tags: UAT 7810, LONGLEASH, LapDogs, ORB Network, China Linked
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/07/china-linked-uat-7810-expands-orb.html
- Canonical: https://runtimerebel.com/blog/uat-7810-expands-lapdogs-orb-network-via-longleash-malware

## Key points

- China-linked threat actor UAT-7810 is compromising internet-facing networking devices to build a sophisticated proxy infrastructure for cyberespionage operations.
- The primary targets include edge networking equipment and legacy devices vulnerable to exploitation, facilitating the LapDogs Operational Relay Box network.
- Organizations must patch edge devices immediately and monitor for unauthorized configuration changes or suspicious outbound traffic to known proxy nodes.

## Expansion of the LapDogs ORB Infrastructure

Security researchers from Cisco Talos have identified a significant expansion in the operations of a China-linked [APT](/glossary#apt) actor tracked as UAT-7810. This group is specifically focused on the maintenance and proliferation of "LapDogs," a sophisticated Operational Relay Box (ORB) network. According to [The Hacker News](https://thehackernews.com/2026/07/china-linked-uat-7810-expands-orb.html), this actor has introduced a new bespoke malware family named LONGLEASH to facilitate these expansions. 

ORB networks represent a pivot in how nation-state actors obfuscate their activities. Unlike traditional botnets that are often used for [DDoS](/glossary#ddos) or mass spam, ORB networks function as highly specialized proxy meshes. By compromising internet-facing networking devices, UAT-7810 creates a multi-layered relay system that allows their primary attack traffic to appear as though it is originating from legitimate, non-adversarial geolocations. This infrastructure is a fundamental component of their [TTP](/glossary#ttp) profile, aimed at circumventing geographic-based access controls and identity-based security perimeters.

### Technical Analysis of LONGLEASH Malware

The introduction of LONGLEASH signifies a refinement in the group's technical capabilities. LONGLEASH is designed to specifically target and persist on edge networking equipment, which often lacks the [EDR](/glossary#edr) visibility found on standard workstations or servers. This malware allows the actor to transform compromised routers and firewalls into active nodes within the LapDogs mesh. 

When security teams investigate **how to detect LONGLEASH malware**, they should prioritize the analysis of volatile memory and system binary integrity on network appliances. The malware facilitates the establishment of [C2](/glossary#c2) channels that are difficult to distinguish from legitimate administrative traffic. Because the malware is bespoke, it often evades signature-based detection, requiring [SOC](/glossary#soc) analysts to rely on behavioral indicators such as unusual outbound connections to non-standard ports or known proxy nodes.

### Strategic Implications for Targeted Sectors

The **UAT-7810 targeted sector** list typically includes government agencies, defense contractors, and critical telecommunications providers. However, the expansion of the LapDogs network often involves the compromise of small-to-medium business (SMB) hardware and legacy consumer routers. These devices serve as the "relay boxes" that hide the actor's ultimate objectives. 

This strategy allows UAT-7810 to launch [Phishing](/glossary#phishing) campaigns or exploit a [Zero-Day](/glossary#zero-day) vulnerability from an IP address that appears benign. The difficulty for defenders is that the source of the attack is a legitimate, albeit compromised, device located within their own region. By the time a [SIEM](/glossary#siem) alert is triggered, the actor has often already achieved [Privilege Escalation](/glossary#privilege-escalation) and begun [Lateral Movement](/glossary#lateral-movement) within the target network.

## Operational Relay Box network defense strategies

Defending against a threat actor that utilizes a dynamic and evolving ORB network requires a comprehensive approach to edge security. Traditional [IoC](/glossary#ioc) blacklisting is frequently ineffective against LapDogs because the relay nodes are cycled regularly, rendering static IP lists obsolete within hours or days. 

Security professionals should implement the following mitigations:

*   **Hardening Edge Interfaces:** Disable all public-facing management interfaces (e.g., SSH, Telnet, Web GUIs) on networking equipment unless absolutely necessary and protected by a VPN.
*   **Firmware Integrity Monitoring:** Regularly verify the integrity of firmware on routers and firewalls to ensure no unauthorized modifications or LONGLEASH components have been installed.
*   **Adopting Zero Trust:** Implement a [Zero Trust](/glossary#zero-trust) architecture that does not grant inherent trust to traffic based solely on its origin IP or internal location.
*   **Traffic Pattern Analysis:** Monitor for persistent outbound tunnels from network devices to unfamiliar external endpoints, which may indicate the device has been incorporated into a proxy mesh.

As UAT-7810 continues to refine its toolkit, the visibility into these obfuscated relay networks remains a primary challenge for modern cyber defense.

**Related:** [TA4922 Expands Phishing Campaigns to Europe and South Africa](/blog/ta4922-expands-phishing-campaigns-to-europe-and-south-africa), [Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing](/blog/silver-fox-deploys-abcdoor-malware-via-tax-themed-phishing)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/uat-7810-expands-lapdogs-orb-network-via-longleash-malware