China-Nexus Actor UAT-7810 Expands Covert ORB Networks with Custom Malware
Cisco Talos reports China-nexus threat actor UAT-7810 is expanding its Operational Relay Box (ORB) networks using custom malware, exploiting vulnerabilities in unpatched routers to deploy new backdoors.
Cisco Talos has identified a significant expansion of Operational Relay Box (ORB) networks by the China-nexus threat actor UAT-7810. This group is deploying a fresh suite of custom malware, including updated versions of the LONGLEASH and DOGLEASH backdoors, by exploiting known vulnerabilities in unpatched Ruckus and ASUS routers. These ORB networks are crucial infrastructure, providing a covert and highly evasive means for other Advanced Persistent Threat (APT) groups to mask their origins and launch attacks against high-value targets.
The primary function of these ORB networks is to create a massive blind spot for defenders. By compromising edge devices such as wireless routers, UAT-7810 constructs a decentralized proxy network that can easily bypass traditional perimeter defenses. This infrastructure allows secondary threat actors to route malicious traffic through seemingly innocuous nodes, making attribution and disruption extremely difficult. The active development and deployment of sophisticated, multi-platform tools like LONGLEASH underscore UAT-7810's commitment to building a resilient and hard-to-dismantle infrastructure.
The exploitation of n-day vulnerabilities in widely used networking hardware like Ruckus and ASUS routers highlights a common tactic among threat actors. These vulnerabilities are often publicly known, and patches are available, but organizations fail to apply them in a timely manner. This leaves a significant attack surface open for exploitation, enabling actors like UAT-7810 to gain a foothold and establish their covert infrastructure. The reliance on these unpatched devices means that a proactive patching strategy is paramount for organizations using this hardware.
The LONGLEASH and DOGLEASH backdoors are central to UAT-7810's operations. These tools are designed to maintain persistence, facilitate command and control, and potentially exfiltrate data or deploy further payloads. The fact that these backdoors are being actively updated suggests that UAT-7810 is continuously refining its toolkit to evade detection and maintain access within compromised networks. Their multi-platform nature indicates an effort to ensure compatibility across various router architectures.
The implications of these expanded ORB networks are far-reaching. They provide a critical enabler for other APT groups, potentially including state-sponsored entities, to conduct their operations with a reduced risk of detection. This could lead to more successful and impactful attacks against critical infrastructure, government entities, and private organizations. The decentralized nature of the ORB network makes it challenging to dismantle entirely, as compromising one node does not necessarily disrupt the entire network.
To mitigate the risks posed by UAT-7810's activities, defenders must prioritize patching all edge devices, especially Ruckus and ASUS routers, against known vulnerabilities. Network monitoring should be enhanced to detect unusual proxying behavior, unauthorized connections, or anomalous traffic patterns on these devices. Cisco Talos has provided a comprehensive list of Indicators of Compromise (IOCs) in their report to aid in the detection and blocking of this malware suite.
This ongoing campaign by UAT-7810 serves as a stark reminder of the persistent threats posed by nation-state-aligned actors and the critical importance of maintaining robust network security hygiene. The continuous evolution of their tactics, techniques, and procedures, particularly in building covert infrastructure, necessitates a vigilant and adaptive defense strategy from cybersecurity professionals worldwide.