China-Linked UAT-7810 Turns Ruckus and ASUS Routers Into Covert Spy Relays — The LapDogs ORB Network Is Growing

If a Chinese state-sponsored hacking group wanted to launch a cyberattack against an Indian enterprise, a government agency, or a critical infrastructure operator — and leave absolutely no fingerprints — what would they do? They would route the attack through your office router. That is precisely what the UAT-7810 APT group is doing right now, and Cisco Talos published a detailed threat brief on their expanding operations this month that every security practitioner in India must read.

Cisco Talos researchers have confirmed that UAT-7810, a China-nexus advanced persistent threat (APT) actor, is actively compromising unpatched Ruckus wireless routers and ASUS AiCloud routers at scale — not to exfiltrate data from those devices, but to conscript them into a sprawling, hidden relay network called LapDogs. The attackers use this Operational Relay Box (ORB) infrastructure to route their malicious traffic through ordinary-looking business routers, making their attacks nearly impossible to trace back to Beijing.

What Is the LapDogs ORB Network — and Why Should You Care?

An Operational Relay Box (ORB) network is an attacker’s dream architecture. Rather than routing command-and-control (C2) traffic directly from a server in, say, Chengdu or Hainan, an APT group hops it through dozens or hundreds of compromised devices scattered across the globe. From the perspective of a network defender, the malicious traffic appears to originate from a Bangalore warehouse router, a Noida branch-office firewall, or a Mumbai co-location device — not from a nation-state operator.

LapDogs is UAT-7810’s proprietary ORB network, first identified by Talos in June 2025. Over the past year, the group has been steadily growing it by compromising internet-facing networking devices using publicly known — but widely unpatched — vulnerabilities. The infrastructure is then leased out (or tasked) to secondary Chinese threat actors, including UAT-5918, a group that has been actively targeting critical infrastructure in Taiwan since 2023.

The strategic logic is simple: if you can make your attack traffic look like it came from a victim’s own suppliers, partners, or industry peers, attribution becomes nearly impossible and defences fail silently.

The CVEs Powering the Campaign

UAT-7810 is not using zero-days. Every CVE in this campaign is a known, patched vulnerability — the attackers are betting, correctly, that a large percentage of deployed hardware will never receive the update.

CVE	Affected Product	CVSS	Type
CVE-2023-25717	Ruckus Wireless Admin ≤10.4	9.8 Critical	Unauthenticated RCE
CVE-2025-2492	ASUS AiCloud (firmware 3.0.0.4_382–3.0.0.6_102)	9.2 Critical	Auth bypass / Arbitrary code
CVE-2020-22653	Ruckus SmartZone Controllers	High	RCE
CVE-2020-22658	Ruckus SmartZone Controllers	High	RCE

CVE-2023-25717 is the most dangerous entry on this list. Ruckus Wireless Admin prior to version 10.4 contains an unauthenticated remote code execution vulnerability that requires nothing more than a crafted HTTP request. A patch has been available since February 2023 — yet Fortinet’s threat telemetry showed an exploitation spike years after disclosure, indicating widespread unpatched deployments. UAT-7810 is now weaponising this same gap.

CVE-2025-2492 in ASUS AiCloud, reported by BleepingComputer, carries a CVSS v4.0 score of 9.2 and allows an unauthenticated network attacker to bypass authentication controls entirely via a specially crafted request, potentially enabling arbitrary code execution. ASUS released updated firmware, but AiCloud-enabled home and small-office routers have notoriously low patch adoption rates.

UAT-7810’s Five-Implant Malware Arsenal: A Technical Breakdown

What distinguishes UAT-7810 from opportunistic botnets is the sophistication of the tooling they deploy after gaining initial access. Cisco Talos’s full analysis describes five distinct implants, all carrying the “LEASH” naming convention used internally by the threat actor:

LONGLEASH is the newest and most capable implant — an evolution of the original SHORTLEASH backdoor. Compiled for MIPS, ARM, and x64 architectures (covering essentially all router hardware), it operates as a fully featured network proxy supporting HTTP, DNS, SOCKS, TCP, ICMP, and UDP tunnelling. Its internal identifier is “ff-agent / nz1.0.” LONGLEASH uses the Boost.Asio, MbedTLS, and Nanopb libraries and spoofs Chrome browser User-Agent strings (Chrome 122.0.6261.95 on Windows) to blend into normal web traffic when beaconing home.

DOGLEASH is a passive Linux backdoor that binds to a hardcoded local port and listens for encoded TCP data. It supports shell execution, file operations, and listener management via hex command codes (0x2268/0x2267 for shell exec, 0x2266 for file read, 0x2271 for file rename). It is deployed via shell scripts that modify iptables firewall rules to create a hidden inbound path. Its passive design makes it particularly hard to detect with outbound traffic analysis alone.

JARLEASH is a Java-based (.jar) administration tool that provides the attackers with a web-based file manager, FTP and SFTP server capabilities, and Netcat deployment for additional connectivity. Most tellingly, the JARLEASH configuration files contain comments written in Simplified Chinese — a forensic artefact that further corroborates the China-nexus attribution.

LEASHTEST is a MIPS-architecture test utility (internally labelled “iot-test”) that the attackers use to verify successful implantation before deploying heavier payloads. Its presence on a compromised device indicates an active operator performing reconnaissance rather than an automated scanner.

Together, these implants give UAT-7810 a compromised router that can silently relay traffic for any secondary APT actor tasked through the LapDogs ORB network — with all outbound connections appearing to originate from a legitimate business IP address.

The India Dimension: Why This Threat Is Acute for the Subcontinent

India’s enterprise and government networks carry significant Ruckus and ASUS SOHO router deployments — particularly in manufacturing, education, hospitality, and SME segments that have not fully migrated to enterprise-grade, centrally managed networking infrastructure. China-nexus APT groups have historically shown strong interest in Indian critical infrastructure, government networks, and defence supply chains. The India-China geopolitical context makes the LapDogs ORB expansion a direct risk to Indian organisations, not an abstract Western concern.

More practically: if a UAT-7810-controlled relay sits inside an Indian network, that network becomes unwittingly complicit in APT attacks on third parties. The Indian organisation will see outbound traffic that looks like normal HTTPS browsing, while its IP address is being used to pivot into another high-value target. The legal and reputational consequences of being an involuntary relay for a Chinese state APT are serious.

It is also worth noting the connection to UAT-5918, the secondary actor that uses LapDogs infrastructure. UAT-5918 has been documented targeting critical infrastructure operators — the kind of targets that have direct parallels in India’s power, telecom, and water sectors. (The Hacker News has the full attribution breakdown.)

What You Should Do: Sanjay Seth’s Expert Defence Checklist

After three decades in network security and zero-trust architecture deployments across Indian enterprises, here is the prioritised response framework I recommend:

1. Audit all internet-facing routing hardware immediately. Pull an inventory of every Ruckus and ASUS device (particularly any running the AiCloud feature) in your environment. If you cannot enumerate your own perimeter, you cannot defend it — this is a zero-trust fundamental.
2. Patch CVE-2023-25717 and CVE-2025-2492 without delay. Ruckus firmware updates are available from the Ruckus support portal. ASUS has released patched firmware for affected AiCloud series — update to a version beyond the 3.0.0.4_382 to 3.0.0.6_102 range and disable AiCloud entirely if the feature is not operationally required.
3. Block or firewall the admin interface of ALL networking hardware. No router admin interface should be reachable from the internet. If you need remote management, place it behind a VPN with MFA. This alone blocks the initial access vector for CVE-2023-25717.
4. Deploy network behavioural analytics. LONGLEASH blends into HTTPS traffic. Signature-based detection will miss it. Look for routers establishing outbound TCP connections to unusual IPs on non-standard ports, especially with abnormal volumes. The known IOC IP ranges from Talos (194.233.92[.]26, 217.15.160[.]247, 217.15.164[.]147, 95.182.100[.]231) should be blocked and hunted in historical logs.
5. Check for the DOGLEASH iptables persistence. On any Linux-based network appliance you manage, inspect iptables rules for unexpected ACCEPT rules on non-standard local ports. DOGLEASH binds to a hardcoded port and survives reboots via modified iptables.
6. Treat all network device traffic as untrusted. A zero-trust architecture that micro-segments router management traffic from production workloads limits the blast radius if a device is compromised. This is not theoretical hardening — it is the difference between “a router was pwned” and “a router was pwned and our core network is now a Chinese APT relay.”
7. Enforce firmware lifecycle policies. Any networking hardware that has not received a vendor security update in the past 12 months should be treated as end-of-life from a risk perspective, regardless of the vendor’s official support timeline. Older Ruckus SmartZone hardware with unfixed CVE-2020-22653/22658 should be decommissioned or isolated.

For organisations relying on FortiGate-centric perimeter architectures, the FortiGuard Labs threat intelligence feed already flags UAT-7810 exploitation attempts. Ensure your FortiGate threat signatures are current and FortiSandbox is inspecting suspicious lateral movement. Additionally, if you are running mixed-vendor VPN infrastructure, apply the same router audit discipline to all internet-edge devices — state APT groups rarely limit themselves to a single vendor.

As I covered recently when discussing the GoldenEyeDog certificate breach, the recurring theme in 2026’s most dangerous attacks is the exploitation of trusted infrastructure. A compromised router does not trigger endpoint detection. It does not generate SIEM alerts. It does not appear in your threat feed. Zero trust — never trust, always verify, even the physical network itself — is the only architecture that accounts for this reality.

Frequently Asked Questions

How do I know if my Ruckus or ASUS router is already compromised by UAT-7810?

Standard firmware integrity checks and router admin dashboards will not reveal LONGLEASH or DOGLEASH — these implants are designed to be invisible to the built-in management interface. Indicators to look for include: unexplained outbound connections to non-local IPs (especially the Talos-published IOC ranges), unexpected iptables rules on appliances you have shell access to, unusual CPU or bandwidth spikes during off-hours, and TLS certificates presented by the device matching the SHA-256 fingerprint c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15 in network captures. If in doubt, a factory reset followed by immediate patching and reconfiguration is the safest remediation path.

Is this campaign targeting Indian organisations specifically?

Cisco Talos has not published a victim list, and UAT-7810’s primary documented activity relates to Taiwan’s critical infrastructure. However, the LapDogs ORB network is geography-agnostic by design — any unpatched Ruckus or ASUS device connected to the internet is a valid target for conscription into the relay network. Given the large installed base of Ruckus and ASUS hardware in Indian SMEs and branch-office environments, Indian organisations are statistically in the target pool, whether or not they are the ultimate adversarial objective.

Does patching the CVEs remove an existing LONGLEASH infection?

No. Firmware patching closes the initial access vector but does not remove malware that is already installed. DOGLEASH, in particular, is designed with iptables-based persistence that survives reboots. A full factory reset of the device is required to evict an active implant. After resetting, apply the latest vendor firmware before reconfiguring the device and re-connecting it to the network.

What is an ORB network, and how is it different from a regular botnet?

A conventional botnet is primarily used for spam, DDoS, or cryptocurrency mining — its compromised nodes are endpoints (PCs, servers). An Operational Relay Box (ORB) network is built specifically for traffic laundering: state APT actors use it to mask the origin of their attacks by routing them through legitimate business infrastructure. The LapDogs ORB network is distinguished by its use as shared APT infrastructure — multiple Chinese threat actor clusters can route their operations through the same pool of compromised routers, making attribution and takedown exceptionally difficult. Think of it as a dark-fibre network owned by Beijing, but physically hosted inside organisations around the world without their knowledge or consent.

---

Your network perimeter is only as trustworthy as its least-patched device. UAT-7810’s LapDogs operation is a textbook example of why zero-trust architecture must extend to the physical network layer — not just identities and applications. If you are uncertain whether your networking hardware inventory is current, monitored, and correctly segmented, now is the time to find out before a Chinese APT operator does it for you.

Ready to conduct a zero-trust network assessment or review your perimeter device security posture? Contact Sanjay Seth for a confidential security consultation — and let’s make sure your infrastructure isn’t quietly doing Beijing’s bidding.