--- title: Chinese hackers develop LONGLEASH malware to expand ORB... description: Chinese threat actor UAT-7810 has developed LONGLEASH, an upgraded version of the SHORTLEASH backdoor, to expand its Operational Relay Box (ORB) network used... canonical: https://daily.dev/posts/chinese-hackers-develop-longleash-malware-to-expand-orb-network-fqahspzn1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Chinese hackers develop LONGLEASH malware to expand ORB network | daily.dev og:description: Chinese threat actor UAT-7810 has developed LONGLEASH, an upgraded version of the SHORTLEASH backdoor, to expand its Operational Relay Box (ORB) network used... og:url: https://daily.dev/posts/chinese-hackers-develop-longleash-malware-to-expand-orb-network-fqahspzn1 og:image: https://api.daily.dev/og/posts/FqAhsPzn1.png og:image:alt: Chinese hackers develop LONGLEASH malware to expand ORB network og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Chinese hackers develop LONGLEASH malware to expand ORB network **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary Chinese threat actor UAT-7810 has developed LONGLEASH, an upgraded version of the SHORTLEASH backdoor, to expand its Operational Relay Box (ORB) network used by China-aligned APTs. Cisco Talos researchers identified the new malware alongside three additional tools: DOGLEASH (a Linux backdoor), JARLEASH (a Java-based admin tool), and LEASHTEST (an IoT device testing utility). LONGLEASH adds significant capabilities over its predecessor including reverse shell, multi-protocol proxying (HTTP, DNS, SOCKS, TCP, ICMP, UDP), SMTP functionality, TLS/PKI support, and self-removal on detection. The group primarily exploits known n-day vulnerabilities in Ruckus and ASUS AiCloud routers to gain initial access, building relay infrastructure that disguises malicious traffic as legitimate local network activity. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs is the UAT-7810 hacking group exploiting to compromise Ruckus routers? UAT-7810 exploits known n-day vulnerabilities CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers for initial access, along with CVE-2025-2492 in ASUS AiCloud routers. These flaws let the China-aligned group compromise unpatched, internet-facing networking devices to expand its ORB relay infrastructure. _Teams tracking router exploitation trends can follow security research like this on daily.dev._ ### What new capabilities does the LONGLEASH malware add compared to SHORTLEASH? LONGLEASH, an upgraded version of the SHORTLEASH backdoor, adds reverse shell functionality, HTTP/DNS/SOCKS/TCP/ICMP/UDP proxying with traffic redirection, SMTP client/server functionality, TLS and PKI support, self-removal upon detection of tampering, and the ability to act as an intermediate C2 server forwarding commands between infected nodes. _Security professionals monitoring evolving backdoor malware can track updates like this via daily.dev._ ### What is an ORB network in the context of Chinese state-sponsored hacking operations? An Operational Relay Box (ORB) network is infrastructure made of compromised internet-facing devices, such as routers, that China-aligned advanced persistent threats use to proxy their traffic through regional devices. This makes malicious traffic appear to originate from legitimate local infrastructure, helping evade detection and complicate attribution for groups like UAT-7810 and UAT-5918. _Understanding proxy infrastructure like ORB networks helps defenders spot evasive traffic patterns via daily.dev._ ## Similar posts on daily.dev - [China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes](https://daily.dev/posts/china-linked-uat-7290-targets-telecoms-with-linux-malware-and-orb-nodes-mwqnesjfg) · The Hacker News · 0 upvotes · 0 comments - [Chinese hackers target telcos with new Linux, Windows malware](https://daily.dev/posts/chinese-hackers-target-telcos-with-new-linux-windows-malware-ql0h0a4gw) · BleepingComputer · 2 upvotes · 0 comments - [A Chinese state-linked botnet has grown to 1,500 hacked routers and is mapping vulnerable targets within hours of disclosure](https://daily.dev/posts/a-chinese-state-linked-botnet-has-grown-to-1-500-hacked-routers-and-is-mapping-vulnerable-targets-wi-xqb8rcet8) · The Next Web · 0 upvotes · 0 comments - [Chinese Cyber Threat Lurks In Critical Asian Sectors for Years](https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/chinese-hackers-develop-longleash-malware-to-expand-orb-network-fqahspzn1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Chinese hackers develop LONGLEASH malware to expand ORB network","url":"https://daily.dev/posts/chinese-hackers-develop-longleash-malware-to-expand-orb-network-fqahspzn1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chinese-hackers-develop-longleash-malware-to-expand-orb-network-fqahspzn1"},"datePublished":"2026-07-07T18:54:27.235Z","dateModified":"2026-09-14T07:12:05.246Z","description":"Chinese threat actor UAT-7810 has developed LONGLEASH, an upgraded version of the SHORTLEASH backdoor, to expand its Operational Relay Box (ORB) network used...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee89cf1329b25f9a65f5c61ab1e0f340?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee89cf1329b25f9a65f5c61ab1e0f340?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chinese-hackers-develop-longleash-malware-to-expand-orb-network-fqahspzn1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Chinese hackers develop LONGLEASH malware to expand ORB network"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/chinese-hackers-develop-longleash-malware-to-expand-orb-network-fqahspzn1#faq","mainEntity":[{"@type":"Question","name":"What CVEs is the UAT-7810 hacking group exploiting to compromise Ruckus routers?","acceptedAnswer":{"@type":"Answer","text":"UAT-7810 exploits known n-day vulnerabilities CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 in Ruckus routers for initial access, along with CVE-2025-2492 in ASUS AiCloud routers. These flaws let the China-aligned group compromise unpatched, internet-facing networking devices to expand its ORB relay infrastructure. Teams tracking router exploitation trends can follow security research like this on daily.dev."}},{"@type":"Question","name":"What new capabilities does the LONGLEASH malware add compared to SHORTLEASH?","acceptedAnswer":{"@type":"Answer","text":"LONGLEASH, an upgraded version of the SHORTLEASH backdoor, adds reverse shell functionality, HTTP/DNS/SOCKS/TCP/ICMP/UDP proxying with traffic redirection, SMTP client/server functionality, TLS and PKI support, self-removal upon detection of tampering, and the ability to act as an intermediate C2 server forwarding commands between infected nodes. Security professionals monitoring evolving backdoor malware can track updates like this via daily.dev."}},{"@type":"Question","name":"What is an ORB network in the context of Chinese state-sponsored hacking operations?","acceptedAnswer":{"@type":"Answer","text":"An Operational Relay Box (ORB) network is infrastructure made of compromised internet-facing devices, such as routers, that China-aligned advanced persistent threats use to proxy their traffic through regional devices. This makes malicious traffic appear to originate from legitimate local infrastructure, helping evade detection and complicate attribution for groups like UAT-7810 and UAT-5918. Understanding proxy infrastructure like ORB networks helps defenders spot evasive traffic patterns via daily.dev."}}]} ```