China-Linked APT UAT- Expands ORB Network Using New LONGLEASH Malware

A China-linked APT group, UAT-, is expanding its ORB network through custom malware like LONGLEASH, exploiting router vulnerabilities to establish persistent access. The group collaborates with other threat actors, employing advanced techniques to maintain control over compromised devices.

A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) network by breaking into internet-facing networking devices.

According to findings from Cisco Talos, UAT-7810 is an advanced persistent threat (APT) actor that's responsible for maintaining and proliferating LapDogs, an ORB network that first came to light in June 2025.

Read original article