UAT-7810 expands LapDogs ORB network to provide covert routing infrastructure
Threat Actor Meta
Summary
Hide ▲
Show ▼
UAT-7810 expanded its LapDogs ORB network, adding covert routing capacity that helps other hackers hide traffic origin and reach high-value targets. The infrastructure now relies on hijacked routers and edge devices and is being paired with new custom malware. Talos assessed the group as China-nexus with high confidence, signaling an active ecosystem that supports espionage operations. The development increases the scale and durability of proxy infrastructure available to allied actors.
Related Happenings
UAT-7810 malware toolkit expansion with LONGLEASH, DOGLEASH, and JARLEASH
Malware Activity
H score27
First: 08.07.2026 17:30
Last: 08.07.2026 17:30
Sources 1
How related:
Talos said UAT-7810 is developing an upgraded backdoor called LONGLEASH, an evolution of an earlier tool that adds proxying features and can even relay commands to other infected machines.
About this happening:
**Chinese threat actor UAT-7810** is **actively refining** its bespoke malware to expand the **LapDogs ORB network** by breaking into **internet-facing networking devices**. The a...
UAT-7810 malware toolkit expansion with LONGLEASH, DOGLEASH, and JARLEASH
Malware ActivityHow related: Talos said UAT-7810 is developing an upgraded backdoor called LONGLEASH, an evolution of an earlier tool that adds proxying features and can even relay commands to other infected machines.
About this happening: **Chinese threat actor UAT-7810** is **actively refining** its bespoke malware to expand the **LapDogs ORB network** by breaking into **internet-facing networking devices**. The a...
UAT-7810 Operational Relay Box network-building campaign
Campaign
H score39
First: 08.07.2026 12:04
Last: 08.07.2026 12:04
Sources 1
About this happening:
An **ongoing UAT-7810 campaign** is expanding **Operational Relay Box (ORB) networks** by breaking into **internet-facing networking devices**, increasing relay capacity for downs...
UAT-7810 Operational Relay Box network-building campaign
CampaignAbout this happening: An **ongoing UAT-7810 campaign** is expanding **Operational Relay Box (ORB) networks** by breaking into **internet-facing networking devices**, increasing relay capacity for downs...
Webworm multi-country targeting campaign against government and enterprise victims
Campaign
H score38
First: 20.05.2026 15:51
Last: 20.05.2026 15:51
Sources 1
About this happening:
**Webworm** is running a **multi-country targeting campaign** against **government agencies and enterprises**, expanding the risk of persistent access across several regions. The...
Webworm multi-country targeting campaign against government and enterprise victims
CampaignAbout this happening: **Webworm** is running a **multi-country targeting campaign** against **government agencies and enterprises**, expanding the risk of persistent access across several regions. The...
AVRecon malware for Linux powering SocksEscort proxy network
Malware Activity
H score19
First: 12.03.2026 18:19
Last: 12.03.2026 18:19
Sources 1
About this happening:
The **AVRecon** malware for Linux powered the **SocksEscort** proxy network, turning compromised **Linux-based SOHO routers** into traffic-routing nodes at scale. It was believed...
AVRecon malware for Linux powering SocksEscort proxy network
Malware ActivityAbout this happening: The **AVRecon** malware for Linux powered the **SocksEscort** proxy network, turning compromised **Linux-based SOHO routers** into traffic-routing nodes at scale. It was believed...
KadNap botnet turns ASUS routers into residential proxies
Malware Activity
H score23
First: 10.03.2026 17:01
Last: 10.03.2026 17:01
Sources 1
About this happening:
The **KadNap** botnet is now compromising **ASUS routers** and other edge networking devices, turning them into **residential proxies** that can hide malicious traffic. The networ...
KadNap botnet turns ASUS routers into residential proxies
Malware ActivityAbout this happening: The **KadNap** botnet is now compromising **ASUS routers** and other edge networking devices, turning them into **residential proxies** that can hide malicious traffic. The networ...
Timeline
-
08.07.2026 17:30 2 articles · 1d ago
UAT-7810 expands LapDogs relay network with new backdoors
Campaign Scope UpdateCisco Talos says UAT-7810, a China-nexus APT group, is expanding its long-running LapDogs Operational Relay Box network of compromised routers and edge devices to provide covert routing for other hackers. The group has targeted unpatched flaws in Ruckus wireless routers since 2025 and began exploiting an ASUS router bug earlier this year, while also developing LONGLEASH, DOGLEASH, and JARLEASH to add proxying, Linux command execution, and server management capabilities.
Show sources
- China-Linked APT Expands Proxy Network With New Malware — www.infosecurity-magazine.com — 08.07.2026 17:30
- China-Linked APT Expands Proxy Network With New Malware — www.infosecurity-magazine.com — 08.07.2026 17:30