As reported by The Hacker News, Cisco Talos researchers have identified new tooling from the Chinese-linked threat actor UAT-7810, whose LONGLEASH malware is actively being used to expand the LapDogs Operational Relay Box (ORB) network — a sophisticated infrastructure designed to obfuscate the origin of state-aligned cyber operations.
Why This Development Matters
ORB networks are not new, but they are becoming increasingly central to how China-aligned APT actors operate. Rather than routing attacks through infrastructure directly attributable to state actors, ORBs leverage compromised commercial and consumer networking devices — routers, firewalls, VPN appliances — as a multi-hop anonymization layer. The LapDogs network represents a mature, professionally maintained relay infrastructure, and the introduction of purpose-built malware like LONGLEASH signals that UAT-7810 is not improvising. This is deliberate, long-term infrastructure investment.
What separates this from opportunistic cybercrime is the operational discipline involved. ORB networks require sustained management: nodes need to be re-compromised as patches are applied, traffic routing must remain undetected, and the infrastructure must scale to support multiple simultaneous campaigns. Bespoke malware development to serve this function tells us that LapDogs is a mission-critical asset, not a convenience tool.
Who Is at Risk
The immediate targets are internet-facing networking devices — the same edge infrastructure that sits at the perimeter of virtually every enterprise, government agency, and critical infrastructure operator. Organizations running unpatched or end-of-life network appliances are the most exposed. However, the downstream victims — those being spied on through LapDogs — are a much broader population. ORB infrastructure is used to conduct reconnaissance, exfiltrate data, and deliver follow-on payloads while defeating geo-blocking, IP reputation filtering, and traditional threat intelligence feeds.
The Broader Strategic Picture
UAT-7810's refinement of LONGLEASH is part of a clear strategic pattern we've observed across China-aligned APT infrastructure over the past 18 months. Groups like Volt Typhoon and Salt Typhoon have popularized the use of living-off-the-land and ORB-based techniques precisely because they defeat signature-based detection and complicate attribution. The development of custom malware specifically for ORB node management represents the next evolutionary step — purpose-built tooling to maintain the anonymization layer itself, not just the target environment.
When a threat actor invests in custom infrastructure malware rather than repurposing commodity tools, it signals a level of operational maturity and resource commitment consistent with state sponsorship. LapDogs is not going away — it will grow.
This also presents a serious challenge for defenders and threat intelligence teams. An organization whose network appliance becomes a LapDogs node may never be directly targeted — but they become complicit infrastructure in attacks against others, opening liability and compliance exposure they never anticipated.
Shield53 Recommendations
Immediate Actions for Network Defenders
- Audit your perimeter devices now. Inventory every internet-facing router, firewall, VPN gateway, and load balancer. Identify anything running outdated firmware or approaching end-of-life status. Prioritize patching or replacement immediately.
- Disable unnecessary management interfaces. Remote management protocols (SSH, SNMP, web UIs) should never be exposed to the public internet. Restrict access to dedicated management VLANs or out-of-band networks.
- Implement behavioral anomaly detection on edge devices. Traditional signature detection will miss LONGLEASH-class malware. Look for unexpected outbound connections from network appliances, unusual process execution patterns, or configuration changes not correlated with change management records.
- Hunt for ORB indicators. Engage your threat intelligence team to identify known LapDogs infrastructure indicators and cross-reference with your firewall and proxy logs. Cisco Talos has published research on this actor — use it.
- Review credential hygiene on all network appliances. Default credentials, shared passwords, and locally managed accounts on edge devices are primary initial access vectors. Enforce MFA where supported and rotate all credentials immediately.
- Establish a baseline for outbound traffic from infrastructure devices. Appliances relaying ORB traffic will exhibit traffic patterns inconsistent with their normal operational profile. NetFlow analysis can surface anomalies that endpoint tools will miss entirely.
Strategic Guidance for CISOs
This campaign reinforces the case for treating network infrastructure as a first-class attack surface, not a trusted control plane. Many organizations still lack the visibility into what their firewalls and routers are actually doing at the network level. If you can't answer "what is my perimeter device talking to right now and why," you have a monitoring gap that adversaries like UAT-7810 are actively exploiting. Investing in network detection and response (NDR) capabilities and out-of-band device integrity verification should be near-term budget priorities.
