Skip to content
Threat Feed
Subscribe

Tag

China-Nexus

4 briefs RSS
high threat

UAT-7810 Expands ORB Networks with New Malware; ARToken Phishing-as-a-Service and Device Vulnerabilities Highlighted

The China-nexus threat actor UAT-7810 is expanding its Operational Relay Box (ORB) networks by exploiting known vulnerabilities in unpatched Ruckus and ASUS routers to deploy custom backdoors like LONGLEASH and DOGLEASH, while other threats include the ARToken Phishing-as-a-Service platform targeting Microsoft 365, critical flaws in AirDrop/Quick Share, and a backdoor in Tenda router firmware.

Ruckus routers +5 UAT-7810 China-nexus APT router-exploitation ORB-network backdoor phishing-as-a-service credential-theft data-exfiltration +3
10t 8i
high threat

UAT-7810 Expands ORB Networks with New Custom Malware: LONGLEASH, DOGLEASH, and JARLEASH

China-nexus APT actor UAT-7810 is actively expanding its LapDogs Operational Relay Box (ORB) network by exploiting N-day vulnerabilities in Ruckus and ASUS routers to deploy new custom malware families including LONGLEASH, DOGLEASH, and JARLEASH, enabling advanced command and control capabilities for secondary threat actors.

exploited PoC Ruckus Wireless Routers +1 UAT-7810 apt malware backdoor orb-network router-exploitation china-nexus linux embedded
1r 7t 4c 4i updated
high threat

China-Nexus Cyber Actors Using Covert Networks of Compromised Devices

China-nexus cyber actors are increasingly using large-scale networks of compromised devices, including SOHO routers and IoT devices, to obscure the origin of their attacks and conduct various malicious activities, from reconnaissance to data exfiltration.

SOHO Routers +5 China-nexus cyber actors covert-network botnet china-nexus compromised-devices
2r 4t
high threat

China-Nexus Campaign Using Google Calendar as C2

A China-nexus threat actor is utilizing Google Calendar as a command and control (C2) infrastructure to conduct stealthy operations.

China-nexus actor google-calendar c2 china-nexus
2r 4t