# China-Linked APT Dramatically Expands Malware Toolkit With Three New Backdoor Variants


Cisco's Talos researchers have uncovered a sophisticated expansion of the LapDogs campaign, revealing that a China-linked APT tracked as UAT-7810 has weaponized at least three newly identified backdoors to maintain persistent access to compromised network infrastructure. The threat actor, already responsible for infecting more than 1,000 SOHO routers, is systematically building what researchers call an "operational relay box" (ORB) network designed for long-term espionage and lateral movement across targeted organizations.


The discovery marks a significant escalation in capability and sophistication for UAT-7810, demonstrating sustained investment in backdoor development and multi-architecture malware engineering.


## The Threat: A Sophisticated Relay Network


UAT-7810's operational strategy centers on converting compromised SOHO routers into a distributed relay infrastructure. Unlike traditional botnet operations focused on volumetric attacks or data exfiltration, the ORB network approach is far more insidious: the compromised routers serve as persistent pivot points that UAT-7810 and affiliated groups can use to:


  • Tunnel traffic through victim networks to evade detection
  • Host command-and-control (C&C) infrastructure internally within targeted organizations
  • Forward commands and data between disparate systems on behalf of attackers
  • Maintain long-term access even after initial intrusions are remediated

    • This architecture is particularly valuable for espionage operations because it compartmentalizes attribution and distributes the operational infrastructure geographically, making attribution and takedown efforts significantly more difficult.


    ## The New Arsenal: LongLeash, DogLeash, and JarLeash


    ### LongLeash: The Evolved Successor


    The most technically sophisticated of the three new backdoors is LongLeash, which represents a direct evolution of the previously known ShortLeash malware that SecurityScorecard documented in 2025. While building on the same foundational codebase as its predecessor, LongLeash incorporates code from two widely-used open-source libraries:


  • Nanopb: A lightweight protocol buffer library commonly used for efficient serialization
  • MbedTLS: An embedded TLS/SSL cryptography library used for secure communications

    • LongLeash retains all core ShortLeash functionality—including C&C communication, web server hosting, tunnel management, and the ability to operate as both client and server—while adding enhanced capabilities. Most notably, the backdoor can function as an intermediate relay server, forwarding commands and data received from the primary C&C to other compromised systems. This design choice reflects an intentional strategy to deepen the ORB network's sophistication.


    ### DogLeash: The Passive Listener


    DogLeash takes a different operational approach, functioning as a passive C-based backdoor designed to minimize network signatures. Deployed via shell script, DogLeash is installed alongside custom iptables firewall rules that whitelist incoming TCP traffic to a specific port where the backdoor maintains a listener socket.


    Once running, DogLeash can execute a comprehensive set of commands received from the C&C operator:


  • Command execution on the compromised system
  • File reading and manipulation (rename, delete, exfiltrate)
  • Socket listener management (start, stop, reconfigure)
  • Operating system reconnaissance (retrieve system information, architecture details)
  • In-memory code execution (load and run arbitrary code without writing to disk)

    • The in-memory execution capability is particularly significant, as it enables operators to deploy additional tools or malicious code without leaving forensic artifacts on the compromised system's storage.


    ### JarLeash: Java-Based Versatility


    JarLeash is a Java-based backdoor that provides operational flexibility through a high-level runtime environment. Deployed via a wrapper script that kills competing backdoor instances before launching the Java virtual machine, JarLeash offers capabilities that exceed traditional Linux backdoors:


  • Web-based file management interface (visual interface for exploring and managing files)
  • FTP and SFTP servers (enable remote file transfer)
  • Netcat server deployment (raw network socket access)
  • Dual deployment (can run on victim systems OR on UAT-7810's internal infrastructure as an attack tool)

    • JarLeash's ability to host file management interfaces and FTP/SFTP services suggests it may be used not just for persistence, but as a staging platform for lateral movement operations within compromised networks.


    ## Background and Context: Years of Refinement


    ### The LapDogs Campaign


    UAT-7810's LapDogs campaign is not new—it has been operationally active for years, focusing relentlessly on specific Ruckus wireless router models. The campaign exploits three known vulnerabilities:


    | CVE ID | Description | Impact |

    |--------|-------------|--------|

    | CVE-2020-22653 | Remote code execution in Ruckus Unleashed | Critical |

    | CVE-2020-22658 | Authentication bypass in Ruckus Unleashed | High |

    | CVE-2023-25717 | Additional RCE vulnerability | Critical |


    These vulnerabilities, some dating back to 2020, suggest that UAT-7810 specifically targets organizations that have not performed timely security updates—a common scenario in SOHO and SMB environments where patching cycles are slower or deprioritized.


    ### Operation WrtHug and Cross-Group Collaboration


    Talos identified an apparent connection between UAT-7810's latest activities and Operation WrtHug, a broader campaign publicly disclosed in November 2025 that targeted Asus AiCloud routers. One of the VPS instances used by UAT-7810 was observed distributing payloads to both Ruckus and Asus routers, suggesting either:


    1. Direct involvement of UAT-7810 in Operation WrtHug

    2. Infrastructure sharing between multiple China-linked APTs targeting router hardware


    ### UAT-5918: Supplied Infrastructure


    Most significantly, Talos notes that UAT-7810 provides infrastructure support to UAT-5918, a separate China-linked APT group. While the two groups maintain distinct tracking designations, they share overlapping tooling and code, suggesting either a supplier-customer relationship or coordinated operations within a larger Chinese threat infrastructure. This arrangement allows UAT-5918 to leverage UAT-7810's relay network without independently managing the ORB infrastructure.


    ## Technical Details: Architecture and Multi-Platform Support


    ### Multi-Architecture Malware Engineering


    A particularly telling technical detail is UAT-7810's investment in cross-architecture malware development. The backdoors are designed to run on:


  • MIPS (common in wireless routers)
  • ARM (modern routers and edge devices)
  • x64 (compromised servers and workstations)

    • This multi-platform approach indicates UAT-7810 has either:


  • In-house malware development capabilities sophisticated enough to manage multiple architectures
  • Access to cross-compilation toolchains and testing infrastructure
  • Partnerships with other development groups or contractors

    • ### LeashTest: Quality Assurance and Future Development


    The discovery of LeashTest, a non-malicious binary designed to test functionality on MIPS platforms, provides a window into UAT-7810's development practices. Talos notes that LeashTest serves as both a functional testing tool and, when discovered on systems, an indicator of compromise (IoC).


    The very existence of LeashTest suggests that UAT-7810 has lower confidence in LongLeash's MIPS implementation than in its ARM or x64 variants. This indicates ongoing development and refinement—the group is not deploying a finished product, but rather actively iterating on MIPS support for future operations.


    ## Implications: Target Profile and Risk Assessment


    ### Organizations at Highest Risk


    Organizations most vulnerable to UAT-7810 campaigns share common characteristics:


  • SOHO or SMB network infrastructure relying on Ruckus or Asus wireless routers
  • Delayed or irregular patching cycles for network hardware
  • Limited network monitoring that may not detect compromised routers immediately
  • Edge device management gaps where routers are deployed but not regularly audited
  • Remote office or branch office deployments with less direct IT oversight

    • ### The Espionage Threat Model


    Unlike commodity malware designed for mass exploitation, UAT-7810's ORB infrastructure targets high-value organizations. The investment in relay infrastructure, multi-architecture support, and coordinated operations with other APTs suggests targets include:


  • Government and military networks (consistent with Five Eyes reporting on Chinese recruitment operations)
  • Research institutions (particularly those studying defense, AI, or biotechnology)
  • Telecommunications providers (critical infrastructure with global connectivity)
  • Financial services (geopolitical and economic espionage)

    • ## Recommendations: Detection and Remediation


    ### For Network Defenders


    Immediate Actions:


  • Identify inventory: Catalog all Ruckus and Asus routers in your environment and verify their firmware versions
  • Patch urgently: Apply the latest firmware updates to routers vulnerable to CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717
  • Monitor for indicators: Search logs and network traffic for connections to the identified malicious IP addresses and domains
  • Review router access: Check router administrative access logs for unusual login attempts or configuration changes

    • Longer-Term Hardening:


  • Network segmentation: Isolate router management interfaces from standard corporate networks
  • EDR and network detection: Deploy endpoint detection and response (EDR) tools to monitor for unusual processes like Java backdoors or passive listeners
  • Firewall rules: Implement egress filtering to restrict router outbound connections to authorized management servers only
  • Regular audits: Perform quarterly vulnerability assessments of network edge devices

    • ### For Organizations Using Ruckus or Asus Infrastructure


  • Contact vendors for extended security support if your devices are outside standard support windows
  • Evaluate alternatives if patching is not feasible; the cost of a router replacement is minimal compared to breach response
  • Implement out-of-band management: Use dedicated management networks or jump hosts to access router administration interfaces

    • ---


    ## HackWire Analysis


    This campaign exemplifies a fundamental shift in APT targeting strategies away from mass exploitation toward infrastructure-as-a-weapon approaches. Rather than selling access or pursuing quick financial gains, UAT-7810 is building a persistent espionage platform explicitly designed for long-term operations against high-value targets.


    What makes this particularly dangerous is the targeting of network edge infrastructure—a part of security architecture that receives far less attention than servers, workstations, or cloud systems. Most organizations invest heavily in endpoint protection and server hardening but treat routers as commodity devices that "just work." UAT-7810 has clearly identified and is systematically exploiting this blind spot.


    The discovery of LeashTest and the ongoing MIPS development work tells us that this campaign is not mature or complete. The adversary is still actively improving their toolkit, suggesting we should expect continued evolution in both capabilities and target scope. Organizations that wait for "all the details" before patching vulnerable routers will likely find themselves on the wrong end of this equation.


    The cross-group coordination between UAT-7810 and UAT-5918 also suggests that Chinese APT infrastructure has moved beyond autonomous group models toward specialized roles—infrastructure development teams, operational teams, and customer groups that divide labor for efficiency and operational security. This is a professionalization of state-sponsored cyber operations that defenders should take very seriously.


    Most critically: if your organization uses Ruckus or Asus routers and has not confirmed firmware versions in the last 90 days, you should treat this as a priority incident response task, not a routine maintenance item.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Advanced Persistent Threats](https://www.hackwire.news/category/advanced-persistent-threats) and [Infrastructure](https://www.hackwire.news/category/infrastructure)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)