Attack Chain

1. Initial Access: UAT-7810 exploits known N-day vulnerabilities (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, CVE-2025-2492) in unpatched Ruckus wireless routers and ASUS AiCloud routers to gain unauthorized access.
2. Execution/Payload Delivery: A shell script is deployed to the compromised router, acting as an initial dropper or loader.
3. Malware Download: The shell script downloads secondary malware payloads, such as DOGLEASH, LONGLEASH, or JARLEASH, from attacker-controlled servers (e.g., 194.233.92[.]26, 217.15.160[.]247, 217.15.164[.]147, 95.182.100[.]231).
4. Persistence/Network Configuration: The shell script adds iptables rules to the compromised Linux-based device, allowing TCP traffic to a specific hardcoded port where DOGLEASH binds and listens for commands.
5. Execution: DOGLEASH (a C-based ELF binary) is executed on the device, binding to its designated port. LONGLEASH (MIPS, ARM, x64 variants) or JARLEASH (JAVA-based) are also executed depending on the target architecture and operational needs.
6. Command and Control (C2): DOGLEASH listens for incoming TCP data, decodes it, and executes arbitrary shellcode. LONGLEASH, named "ff-agent" internally, establishes reverse shells, HTTP, DNS, SOCKS, TCP, ICMP, and UDP proxy servers, and can act as an intermediate C2 server, forwarding commands. JARLEASH provides file management, FTP, SFTP, and Netcat capabilities.
7. Network Establishment: The compromised router becomes part of the LapDogs Operational Relay Box (ORB) network, providing resilient and covert infrastructure for command and control.
8. Impact Operations: The established ORB network is subsequently leveraged by associated secondary threat actors to conduct their own malicious attacks, potentially involving data exfiltration, further lateral movement, or other objectives against high-value targets.

Impact

The primary impact of UAT-7810's activities is the establishment and expansion of the LapDogs Operational Relay Box (ORB) network, which serves as critical infrastructure for other China-nexus APTs. Compromised routers, specifically Ruckus wireless and ASUS AiCloud devices, are transformed into C2 nodes and traffic relays, providing anonymity and resilience for subsequent attacks. This infrastructure facilitates a wide range of malicious operations against high-value targets, including government entities, critical infrastructure, and other sensitive organizations, potentially leading to widespread data breaches, espionage, and disruption. The exact number of victims is not specified, but the continuous development of sophisticated custom malware and active exploitation of N-day vulnerabilities indicate a significant, ongoing threat aimed at enabling broad-scale APT operations.

Recommendation

• Immediately patch all Ruckus wireless routers and ASUS AiCloud routers against CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492 to mitigate initial access vectors.
• Block inbound and outbound connections to the observed C2/payload distribution IP addresses 194.233.92[.]26, 217.15.160[.]247, 217.15.164[.]147, and 95.182.100[.]231 at the network perimeter.
• Deploy the Sigma rule "Detect Suspicious Iptables Rule Modifications for DOGLEASH" to your SIEM to identify iptables modifications indicative of DOGLEASH deployment on Linux-based network devices.
• Enable comprehensive logging for process creation and command execution on all Linux-based networking devices, specifically focusing on iptables commands.