CHINESE HACKERS DEPLOY LONGLEASH MALWARE

UAT-7810 operators are leveraging LONGLEASH to compromise networking infrastructure and establish relay nodes within their ORB network. The malware targets vulnerabilities in Ruckus routers, exploiting devices that lack security patches. Operational Relay Boxes serve as intermediary nodes for command-and-control communications and lateral movement across compromised networks. By expanding their ORB infrastructure, the threat actors increase their operational flexibility and resilience. Security researchers recommend organizations immediately patch Ruckus devices and segment network access to limit exposure. Administrators should audit internet-facing networking equipment for unauthorized access and monitor for suspicious relay traffic. The campaign reflects broader trends of state-sponsored actors targeting network infrastructure to establish persistent footholds within target organizations.