UAT-7810Threat actor
UAT-7810 is an APT actor responsible for maintaining the LapDogs ORB network and developing custom malware, including the backdoors SHORTLEASH and LONGLEASH, as well as DOGLEASH and JARLEASH. They exploit known vulnerabilities in unpatched Ruckus wireless routers and have been observed using infrastructure to host malicious payloads across various hardware platforms.From MISP Galaxy
Last reported 18 days ago, by The Hacker News4 reports
ATT&CK techniques
6 of 37 · each with the sentence it comes from- T1105Ingress Tool Transfer
“T1105 Ingress Tool Transfer”
- T1684Social Engineering
“…rs and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques.”
- T1005Data from Local System
“T1005 Data from Local System”
- T1008Fallback Channels
“T1008 Fallback Channels”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan“… associated with an Operational Relay Box (ORB) network, although there is no evidence it's part of any known ORBs such as LapDogs (aka UAT-7810), SPACEHOP, and FLORAHOX.”
-
SMTP is the key: BPFDoor and AVERAT hitting the network edge“We found no infrastructure or indicator overlap with any specific named ORB network (LapDogs/UAT-7810, SPACEHOP, or FLORAHOX), whose documented targeting instead centers on SOHO routers; AVERAT's infrastructure is consistent with the broader ORB device-class pattern rather than c…”
-
Cyber Brief 26-08 - July 2026“China-linked UAT-7810 expanded ORB network with new backdoors”
-
July 2026 Threat Trend Report on APT Groups“UAT-7810 targeted unpatched Ruckus wireless routers and ASUS AiCloud routers to deploy LONGLEASH, DOGLEASH, and JARLEASH, thereby establishing an ORB network.”
Indicators in its reports
named in the reports above- mx.zxopfds[.]comin 2 reports
- cert[.]lvin 1 report
- spamsniper[.]pidin 1 report
- a37ea9897221d449…ee58931adbf3in 1 report
- 7e667ba5f9df912e…18ebd925b1b5in 1 report
- a6f3b7f932761fb1…65da195bfa7ain 1 report
- 4435fcd686292109…13ee8e226ef9in 1 report
- 652508a9cf40bee8…c21f73b4963fin 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.