Cisco Talos: UAT-7810 Evolves ORB Network with New Custom Malware for MIPS, ARM, and x64 Devices

Executive Summary

Cisco Talos has uncovered continued development and operational activity from the threat actor tracked as UAT-7810. This group, known for compromising networking devices to build operational relay box (ORB) networks for anonymizing their traffic, has expanded its malware toolkit. Researchers have identified a new version of the SHORTLEASH backdoor, now dubbed LONGLEASH, as well as two entirely new malware families: a C-based backdoor named DOGLEASH and a Java-based backdoor named JARLEASH. This evolution demonstrates the actor's commitment to enhancing its capabilities and expanding its network of compromised devices, which includes various hardware platforms and routers like those from ASUS.

Threat Overview

• Threat Actor: UAT-7810
• Objective: To build and maintain a network of compromised networking devices (ORB network) to use as proxies for hiding malicious traffic and launching attacks.
• Malware Arsenal:
  • SHORTLEASH: The original backdoor used by the group.
  • LONGLEASH: An updated, newer version of the SHORTLEASH backdoor.
  • DOGLEASH: A new, previously unknown C-based backdoor.
  • JARLEASH: A new, previously unknown Java-based backdoor.
• Targeted Platforms: The malware is designed for cross-platform compatibility, with variants for MIPS, ARM, and x64 architectures, which are common in routers, IoT devices, and servers.

Technical Analysis

UAT-7810's methodology involves scanning for and exploiting vulnerabilities in internet-facing networking devices to implant its backdoors. Once a device is compromised, it becomes part of the ORB network.

Malware Details

• LONGLEASH: As an evolution of SHORTLEASH, this backdoor likely includes enhanced persistence mechanisms, improved C2 communication protocols, and anti-analysis features.
• DOGLEASH: Being C-based, this backdoor is likely compiled for various architectures (MIPS, ARM) to target a wide range of embedded devices and routers. It probably provides standard backdoor functionality like remote shell access and file transfer.
• JARLEASH: The use of Java indicates the actor is also targeting devices and servers with a Java runtime environment. Java-based malware offers high portability across different operating systems.

Infrastructure

Talos identified four new servers used by UAT-7810 to host these malware payloads. These servers act as download cradles for newly compromised devices. Analysis of this infrastructure linked one of the IP addresses to the exploitation of CVE-2025-2492 in ASUS AiCloud Routers, confirming the actor's TTP of exploiting public-facing vulnerabilities (T1190 - Exploit Public-Facing Application).

Impact Assessment

The expansion of UAT-7810's ORB network poses a significant threat. By routing their attacks through a distributed network of compromised home and business routers, the threat actor can:

• Obfuscate Their Origin: Make it extremely difficult for defenders and law enforcement to trace attacks back to the source infrastructure.
• Launch Attacks at Scale: Use the combined bandwidth of the ORB network to conduct DDoS attacks or large-scale scanning.
• Bypass Geofencing: Launch attacks that appear to originate from legitimate residential or corporate IP addresses, bypassing IP-based blocklists and security controls.

IOCs — Directly from Articles

The following IP addresses were identified as hosting malicious payloads for UAT-7810:

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect UAT-7810 activity:

Detection & Response

1. Network Traffic Monitoring: Ingest firewall and NetFlow logs into a SIEM. Create rules to alert on any communication with the known UAT-7810 C2 IPs. Pay close attention to traffic originating from network infrastructure devices.
2. Firmware Integrity: For critical networking devices, periodically check the integrity of the running firmware against the vendor's official versions to detect unauthorized modifications.
3. Endpoint Monitoring on Devices: Where possible (e.g., on Linux-based routers with shell access), monitor for suspicious running processes, unexpected open ports, and unauthorized scheduled tasks (cron jobs).

Mitigation

1. Patch Management for Network Devices (D3-SU: Software Update): The primary defense is to ensure all internet-facing networking devices (routers, firewalls, VPN concentrators) are running the latest firmware versions. This mitigates the initial access vector of exploiting known vulnerabilities like CVE-2025-2492. Reference MITRE M1051 - Update Software.
2. Restrict Management Interface Access: The management interfaces of all networking devices should not be exposed to the internet. Access should be restricted to an internal, trusted management network. Reference MITRE M1035 - Limit Access to Resource Over Network.
3. Change Default Credentials: Immediately change any default administrator passwords on networking devices. Use strong, unique passwords for each device. Reference MITRE M1027 - Password Policies.