# Chinese APT Deploys LONGLEASH Malware to Build Persistent Relay Infrastructure via Ruckus Router Vulnerabilities


A Chinese-linked threat actor tracked as UAT-7810 has been actively developing and deploying a new malware variant called LONGLEASH to systematically compromise unpatched Ruckus networking devices, establishing a distributed network of Operational Relay Boxes (ORBs) for command-and-control infrastructure. The campaign represents a shift toward persistence-focused tactics, leveraging pervasive network hardware as a foundation for long-term offensive operations.


Security researchers monitoring the activity have documented multiple campaigns targeting organizations across North America and Europe throughout the past six months, with infection vectors including both direct vulnerability exploitation and supply-chain adjacent attack patterns. The use of commodity networking devices—often overlooked in security assessments—underscores a persistent blind spot in enterprise network defense.


## The Threat


LONGLEASH is a modular malware framework designed to establish relay points within compromised networks. Once deployed to a Ruckus router, it enables:


  • Persistent backdoor access without touching endpoint security tools
  • Traffic interception and redirection for man-in-the-middle operations
  • Lateral movement staging for secondary payload deployment
  • Command relay functionality allowing operators to maintain control even if primary C2 infrastructure is disrupted
  • Evasion of network perimeter defenses by operating at the routing layer

    • The malware persists through firmware-level modifications and survives standard device resets by maintaining copies in alternate flash memory regions. This architectural approach mirrors techniques previously observed in sophisticated nation-state campaigns targeting critical infrastructure.


    ## Background and Context


    UAT-7810—a designation used by multiple cybersecurity firms tracking Chinese government-affiliated APT operations—has historically focused on telecommunications, energy, and technology sector targets. The group's shift toward router infrastructure reflects broader trends in APT tradecraft:


    | Aspect | Historical Approach | Current Campaign |

    |--------|-------------------|------------------|

    | Target Layer | Endpoints and servers | Network infrastructure |

    | Persistence Method | Scheduled tasks, registry modifications | Firmware and hardware-level changes |

    | Detection Difficulty | Medium (endpoint tools can detect) | High (pre-OS layer) |

    | Operational Lifespan | Months to years | Potentially indefinite across device refresh cycles |


    Ruckus Networks, a subsidiary of CommScope, manufactures enterprise-class wireless access points and controllers widely deployed in education, hospitality, healthcare, and corporate environments. The vulnerability chain targeted by LONGLEASH affects:


  • Ruckus ZoneDirector appliances (controllers managing wireless networks)
  • Ruckus SmartZone cloud-managed wireless platforms
  • Ruckus Access Points (802.11ac and Wi-Fi 6 models)

    • Affected versions include firmware releases from 2019 through early 2024, with patches available but adoption rates remaining below 40% according to vulnerability scanning telemetry. The delayed patching likely stems from operational friction—many organizations avoid controller reboots during business hours—creating an extended exploitation window.


    ## Technical Details


    LONGLEASH operates through a two-stage infection process:


    Stage 1: Initial Compromise

  • Exploits unauthenticated API endpoints in Ruckus management interfaces
  • Alternatively, leverages weak default credentials still present in many deployments
  • Deploys a minimal dropper payload that establishes outbound HTTPS connectivity to attacker-controlled servers

    • Stage 2: Relay Installation

  • Downloads the full LONGLEASH payload
  • Injects code into the device's firmware using undocumented flash memory regions
  • Modifies boot sequence to execute relay functionality before the legitimate operating system loads
  • Establishes persistent C2 communication using domain-generation algorithms (DGA) as fallback

    • Command-and-Control Architecture:

    The ORB network functions as a decentralized relay mesh. Each compromised router can:

  • Receive commands from operator-controlled servers
  • Relay traffic to other ORB nodes
  • Proxy C2 communications for downstream victims
  • Collect network reconnaissance data

    • This approach provides operational resilience; taking down one C2 server does not disrupt the entire network, and attackers can offload traffic across dozens of compromised devices.


    Detection Evasion Techniques:

  • Traffic encryption using TLS with certificate pinning to trusted-looking domains
  • Low-volume communication patterns (commands typically transmitted once per 6-24 hours)
  • Exploitation of firmware-level access to disable device logging
  • Modification of SNMP and syslog interfaces to prevent alerting

    • ## Implications for Organizations


    Immediate Risks:


  • Network visibility loss: Network monitoring tools typically operate at layers above the router, meaning compromise is invisible to traditional IDS/IPS systems
  • Full network compromise: An attacker with relay access can reposition within the network laterally without traversing monitored segments
  • Man-in-the-middle capabilities: Interception of HTTPS sessions if device can inject certificates or modify TLS handling
  • Supply chain exposure: Organizations using Ruckus for customer-facing wireless networks (hotels, enterprises providing guest Wi-Fi) may unknowingly provide attacker infrastructure

    • Affected Industries:

  • Healthcare: Wireless patient monitoring systems and medical device communication
  • Education: University campus networks and research system interconnects
  • Hospitality: Guest networks potentially routing business communications
  • Financial services: Branch office and remote site connectivity

    • Notably, organizations with mature network segmentation—where management traffic is isolated from production networks—face lower risk, as the relay cannot easily pivot to critical systems. Organizations with flat networks where any device can reach domain controllers or data repositories face substantially higher exposure.


    ## Recommendations


    Immediate Actions (Days 1-7):

    1. Identify affected devices: Query inventory for Ruckus controllers and APs with firmware version < current patch level

    2. Isolate management interfaces: Restrict access to Ruckus management ports (8443 for ZoneDirector, 8000-8080 for SmartZone) to dedicated administrative networks

    3. Enable default credential checks: Audit devices for default username/password combinations; change immediately if present

    4. Capture baseline config: Export configuration backups to verify no unauthorized modifications


    Medium-term Response (Weeks 2-4):

    1. Staged firmware patching: Apply latest Ruckus firmware updates in maintenance windows, prioritizing:

    - Internet-facing controllers first

    - Controllers managing sensitive network segments

    - Controllers with highest device density

    2. Network segmentation audit: Ensure management interfaces cannot communicate with business-critical systems

    3. Threat hunting: Analyze firewall and proxy logs for communication to known attacker C2 infrastructure:

    - Look for unusual outbound HTTPS connections from router IP addresses

    - Flag connections to DGA-generated domains (check emergingthreats.net for LONGLEASH IoCs)


    Long-term Strategy (Month 2+):

    1. Network detection: Deploy network behavioral monitoring to detect anomalous traffic patterns from network infrastructure

    2. Zero-trust re-architecture: Implement device authentication and encryption for management plane traffic

    3. Hardware refresh cycle: Prioritize replacement of end-of-life Ruckus equipment with vendor-maintained alternatives

    4. Supply chain governance: Establish firmware verification policies requiring signed updates and mandatory cryptographic verification


    ---


    ## HackWire Analysis


    This campaign crystallizes a critical gap in enterprise security thinking: the assumption that network infrastructure is a defensive boundary rather than a legitimate attack surface. For years, the industry treated routers and switches as "boring" infrastructure, deploying the latest EDR, SIEM, and firewall technologies while leaving the gear that *forwards the traffic to those tools* unpatched and unmaintained.


    What's particularly damning about LONGLEASH is its exploitation of the organizational delay bias—the documented fact that enterprises take 6-18 months to patch commodity hardware in production networks. A Ruckus controller managing your corporate Wi-Fi isn't viewed as security-critical like an Active Directory server, so patches languish in change-control queues. Meanwhile, an attacker sits inside your network relay, collecting traffic, watching for lateral movement opportunities, and maintaining persistence across your incident response efforts.


    The relay-box pattern should also trigger historical pattern recognition: this mirrors the GifsGalore campaign (Chinese-linked attackers using compromised routers to position for telecom targeting), the Winnti group's use of network infrastructure for persistence, and ISP-level attacks observed against Huawei and Cisco devices. Each iteration teaches adversaries that the network layer is underdefended and underleveraged by most organizations. By the time Blue Team wakes up to a given technique, Red Team is already on to the next one.


    The concrete next step for defenders isn't complicated but requires discipline: treat network infrastructure with the same patch discipline as servers. If a firmware update requires a reboot, schedule the reboot. If default credentials are allowed on your routers, fix that today—not next quarter. And if you're still relying purely on endpoint visibility to detect compromise, understand that you're blind to an entire layer of attack surface.


    For MSPs and hosting providers, the risk is adjacent but more acute: a single compromised customer's Ruckus network can become a staging ground for attacks against your other customers, especially if they're on the same upstream links. — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)