As reported by BleepingComputer, Chinese-linked threat actor UAT-7810 has developed a new malware strain dubbed LONGLEASH, purpose-built to compromise internet-facing networking devices and conscript them into an Operational Relay Box (ORB) network. This development deserves serious attention from network defenders and security leaders alike — not because it's a dramatically novel technique, but because it represents the continued maturation and professionalization of state-sponsored proxy infrastructure.

Threat Intelligence: As reported by BleepingComputer, Chinese-linked threat actor UAT-7810 has developed a new malware strain dubbed LONGLEASH, purpose-built to compromise internet-facing networking devices and conscript them into an Operational Relay Box (ORB) network.

Why ORB Networks Are a Strategic Threat Multiplier

ORB networks — sometimes called "proxy mesh" infrastructure — are fundamentally designed to obscure attack origins. By routing malicious traffic through layers of compromised residential routers, SOHO devices, and now enterprise-grade networking hardware like Ruckus routers, threat actors like UAT-7810 effectively launder their operational footprint. This is not just a technical challenge; it's a strategic one. When defenders can't reliably attribute traffic to a known-malicious IP, network-layer blocking becomes nearly useless, and threat hunting requires far more nuanced behavioral analysis.

What makes the LONGLEASH campaign particularly concerning is its deliberate targeting of unpatched networking infrastructure. Routers and wireless controllers are frequently overlooked in enterprise patch management cycles. They often run firmware for years without updates, sit at the network perimeter with privileged routing access, and generate logs that security teams rarely scrutinize with the same rigor applied to endpoint or server telemetry. UAT-7810 is exploiting exactly this gap.

The Broader ORB Ecosystem: A Growing Industry

It's worth contextualizing LONGLEASH within the broader Chinese cyber operational framework. Multiple Chinese APT clusters — including those aligned with Ministry of State Security (MSS) and People's Liberation Army (PLA) interests — have increasingly adopted ORB infrastructure as a shared operational resource. Mandiant and other researchers have documented how ORB networks are sometimes maintained by contractors and leased across different threat actor groups, effectively turning compromised devices into a commodity service. UAT-7810's development of purpose-built malware to grow this infrastructure suggests this group is either a builder/operator of such a network or is closely integrated with one.

When a threat actor invests in bespoke malware specifically to expand proxy infrastructure rather than to directly conduct espionage, it signals long-term operational planning — not opportunistic intrusion.

Who Is Most at Risk

The Broader ORB Ecosystem: A Growing Industry
Organizations running Ruckus wireless infrastructure, particularly those with internet-exposed management interfaces or outdated firmware
Managed Service Providers (MSPs) and telecommunications companies, which often manage large inventories of networking devices across customer environments
Critical infrastructure operators in sectors historically targeted by Chinese APT groups: defense, energy, semiconductor, and government
Any organization with unmanaged or poorly inventoried edge devices — which, frankly, describes the majority of mid-market enterprises

Detection Is Harder Than It Sounds

Traditional detection approaches struggle against ORB-relayed attacks. Blocklists become stale within hours. Geographic IP filtering is ineffective when traffic routes through domestic ISP infrastructure. Defenders need to shift focus toward behavioral anomaly detection on the network edge: unexpected outbound connections from routers, unusual firmware modification activity, irregular management plane access, and lateral movement from network devices into adjacent segments.

Importantly, organizations should audit whether their networking devices are capable of generating meaningful security telemetry in the first place. Many SOHO and SMB-grade devices cannot integrate with SIEM platforms. If your edge devices are effectively blind spots, that's the first problem to solve.

Shield53 Recommendations

Immediate Actions

  • Audit and patch Ruckus devices immediately. Check Ruckus Security Advisories and ensure all internet-facing controllers and access points are running current firmware. Disable remote management interfaces that are not strictly necessary.
  • Enumerate all internet-exposed networking devices in your environment. Use tools like Shodan or your own external attack surface management platform to identify what's visible from the internet.
  • Restrict management plane access to dedicated out-of-band management networks or VPN-protected jump hosts. No networking device management interface should be exposed directly to the internet.
  • Implement network device logging and route those logs to your SIEM. Authentication events, configuration changes, and unusual outbound connections from routers are high-value signals.
  • Review firewall rules for egress traffic originating from your network infrastructure devices. Routers should not be initiating connections to arbitrary external IPs.

Strategic Actions

  • Incorporate network device firmware into your formal vulnerability management and patching program — with the same SLAs applied to servers and endpoints.
  • Evaluate whether your current NDR (Network Detection and Response) tooling provides adequate visibility into east-west and north-south traffic anomalies at the network edge.
  • Brief your leadership on ORB network threats — the risk isn't just that your devices get compromised; it's that your infrastructure becomes an unwitting launch pad for attacks on others, creating potential legal and reputational exposure.

The LONGLEASH campaign is a reminder that Chinese state-aligned threat actors are playing a long game. They're not just breaking into targets — they're systematically building the infrastructure to do so at scale, with deniability baked in. Defenders who aren't actively hardening their network edge are, effectively, helping them build it.