There are threat actors who steal things, and there are threat actors who build things. The most operationally sophisticated Chinese APT activity in 2026 belongs to the second category. Cisco Talos published a detailed technical report this week on UAT-7810, a China-nexus group that has been quietly constructing what amounts to a managed relay network — compromised home and small business routers turned into covert infrastructure that other threat actors can then use to conduct their own operations against high-value targets, with the geographic fingerprints pointing back to legitimate internet users rather than anything attributable.
The campaign is called LapDogs. The new malware families are called LONGLEASH, DOGLEASH, and JARLEASH. Together they represent a significant maturation of the tooling supporting what the intelligence community has been calling Operational Relay Box (ORB) networks — the infrastructure layer sitting behind Chinese espionage operations that has made attribution and disruption substantially harder than it used to be.
What UAT-7810 Is Actually Building
To understand why this matters, it helps to understand what problem ORB networks are solving for Chinese intelligence operations.
The older model of APT infrastructure involved dedicated attack servers, VPS hosts, and bulletproof hosting. These are detectable, blockable, and burn relatively quickly once they appear in threat intelligence feeds. The newer model involves building proxy infrastructure out of devices that legitimate users own: home routers, small business Wi-Fi equipment, IP cameras. Connections routed through these devices look like they originate from residential or small business IP addresses scattered across the target country’s own territory. Geographic blocking fails. Reputation scoring fails. The apparent source of the traffic is a router belonging to a dentist’s office in Manchester or a small hotel in Stockholm.
UAT-7810’s specific role, as Talos describes it, is to build and maintain this relay layer and make it available to secondary threat actors — notably UAT-5918, a separate China-linked group with documented targeting of government, critical infrastructure, and research organizations. UAT-7810 is the contractor; UAT-5918 and others are the clients. This division of labour is itself intelligence about how Chinese state-sponsored operations are structured: specialised teams handling infrastructure separately from the groups conducting actual espionage operations, with tooling and compromised nodes passed between them.
The Malware: Three Tools, Three Roles
What makes the Talos report particularly valuable is the technical depth on the new malware families. LONGLEASH, DOGLEASH, and JARLEASH each serve a distinct purpose in the operational lifecycle.
LONGLEASH: The Workhorse
LONGLEASH is the successor to SHORTLEASH, first documented by SecurityScorecard in 2025. Internally the project is called “ff-agent,” with version strings indicating active development (“nz1.0”). It runs on MIPS, ARM, and x64 architectures — meaning it can be dropped onto a wide range of networking hardware — and is built on Boost.Asio, a mature C++ library for asynchronous networking operations.
The capabilities list is extensive. LONGLEASH can function as both a C2 client (connecting out to attacker infrastructure) and a C2 server (receiving connections and forwarding them), making it the flexible middle layer of a relay chain. On the proxy side, it supports HTTP, DNS, SOCKS, TCP, ICMP, and UDP protocols — effectively any protocol a secondary attacker might want to tunnel through the compromised device. It also runs an SMTP server and client, which is useful for exfiltration and for sending credentials through channels that appear to be routine mail traffic.
Two implementation details stand out. First, LONGLEASH uses MbedTLS for certificate management, and its TLS infrastructure carries a certificate where every subject field — country, state, city, organisation, organisational unit, common name — is set to the single word “exploit.” This is presumably a test or staging artefact that made it into production, and it is a clean detection signal: that specific TLS fingerprint does not appear in legitimate traffic.
Second, the malware includes a self-destruction mechanism that activates when it detects tampering. This is not unusual in sophisticated implants, but it does indicate that operational security and evidence elimination are built-in requirements, not afterthoughts.
DOGLEASH: The Passive Listener
DOGLEASH is structurally simpler but operationally distinct from LONGLEASH. It is a passive backdoor — meaning it does not initiate connections out but instead binds to hardcoded listening ports and waits for incoming commands. This matters for detection: passive backdoors do not generate outbound connection events that network monitoring typically flags. You have to look at what is listening on the device, not what it is calling home to.
Deployment is via shell script, which means initial access has already been achieved before DOGLEASH is installed. Once running, it accepts TCP connections, decodes incoming traffic using password-protected strings, and executes commands via /bin/sh -c. The command set covers the essentials: shell command execution (0x2268, 0x2267), file read (0x2266), file backup/rename (0x2271), and system information retrieval (0x3450) including OS release, hardware ID, and node name.
DOGLEASH appears to serve as a persistent fallback — something installed early in a compromise that provides access even if the more capable LONGLEASH agent is later detected and removed.
JARLEASH: The Administrator’s Tool
JARLEASH is the most unusual of the three, not for what it does but for what it reveals about how UAT-7810 manages its compromised node inventory. It is a Java-based backdoor that provides a web-based file management interface, FTP and SFTP server hosting, and the ability to deploy netcat instances. The embedded configuration files contain Chinese-language comments — an operational security lapse that is both useful for attribution and consistent with the internal tooling of a Chinese-language development team not expecting their code to be analysed.
The web file management interface suggests JARLEASH is intended for day-to-day maintenance of compromised devices: uploading new payloads, retrieving data, running quick checks. It is an administrative console built into the implant, which implies that managing a large fleet of compromised routers requires tooling analogous to what legitimate systems administrators use for device management.
LEASHTEST: Signalling Ongoing Development
Talos also identified a non-malicious testing binary called LEASHTEST — an internal MIPS test tool named “iot-test” that validates threading, TCP port binding, child process creation, asynchronous timers, and exception handling. The presence of a dedicated test harness indicates that UAT-7810 is doing structured software development: building, testing, and iterating on their malware in a way that more closely resembles a professional engineering team than the improvised tooling of a typical criminal actor.
Targeting and Exploitation
UAT-7810’s access strategy focuses on n-day vulnerabilities in SOHO networking equipment — known bugs with available patches that a significant portion of the installed base is not running.
The primary targets have been Ruckus wireless routers, exploited through CVE-2020-22653, CVE-2020-22658 (dating from 2020), and CVE-2023-25717. The gap between discovery and patch uptake on consumer and small business networking hardware is measured in years, not months. A vulnerability disclosed in 2020 will have a large exploitable population in 2026. In early 2026, the group added ASUS AiCloud routers via CVE-2025-2492.
This targeting profile is deliberate. SOHO routers are chosen not for the data they hold but for their network position, their architectural diversity (MIPS and ARM hardware from multiple vendors), and the reality that they are almost never monitored. Enterprise security tooling sits inside the network, behind these devices. The router logs that might reveal compromise are rarely reviewed, and firmware is rarely updated.
The C2 Infrastructure
Talos documented four C2 and payload-hosting servers active at time of reporting: 194.233.92[.]26, 217.15.160[.]247, 217.15.164[.]147, and 95.182.100[.]231 (the last geolocating to Hong Kong). Active ports are 99 (TLS), 2222, and 8088. The TLS certificate on port 99 carries the fingerprint c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15 — the one with “exploit” in every field.
Talos has published SNORT SIDs (66433, 66430–66432, 301493) and ClamAV signatures covering LONGLEASH, DOGLEASH, JARLEASH, and LEASHTEST across MIPS32, MIPS32r2, and ARMv7 variants. These provide detection opportunity for organisations with the necessary network visibility, but the fundamental detection challenge remains: traffic flowing through a compromised SOHO router looks like normal internet traffic from a normal user’s IP address, and very few organisations are positioned to inspect the routing infrastructure sitting between them and the internet.
The Layered Operation: UAT-7810 and UAT-5918
The two-group structure Talos describes is worth dwelling on. UAT-5918 is a separate tracked group with documented compromises of government, critical infrastructure, and research targets across Taiwan, the Philippines, Japan, and other countries within China’s regional intelligence interest. Talos notes overlapping tooling between the two groups and describes UAT-7810 as providing infrastructure that UAT-5918 uses to operate.
This represents a maturation in how Chinese state-sponsored cyber operations are conducted. The groups responsible for building and maintaining relay infrastructure are separated from the groups conducting actual espionage. This division reduces risk: if LONGLEASH gets burned, the secondary operators still have their access to the final target networks; if an espionage operation is detected, it does not immediately expose the infrastructure group’s node inventory. Each layer of the operation can lose a component without the whole structure collapsing.
It also complicates attribution. A compromise of a Taiwanese government system attributed to UAT-5918 will not, in normal forensic work, surface the UAT-7810 infrastructure it transited. You would need to be simultaneously monitoring the compromised SOHO router sitting between the victim and the actual attackers — and tracking which IP addresses are connected to it from which directions — to see the full chain.
For Defenders
The detection problem here does not have an easy answer, and Talos is not pretending it does.
Network defenders protecting high-value targets — government, critical infrastructure, research, financial sector — should assume that inbound traffic from residential and small business IP addresses can originate from the adversary’s relay infrastructure. Blocking residential IP ranges entirely is not feasible for most operations. Behavioural analysis — patterns of access that look anomalous for a residential source, unusual timing, unusual protocol combinations — offers more traction than reputation-based controls.
Organisations whose attack surface includes consumer networking equipment (ISPs, enterprise environments with distributed branch offices, organisations issuing home networking hardware to staff) should audit what firmware those devices are running. The Ruckus CVEs being actively exploited in 2026 were disclosed in 2020 and 2023. Many of those devices remain unpatched not because patches do not exist, but because no one has applied them.
The specific IOCs Talos has published — the TLS certificate fingerprint, the C2 IP addresses, the ClamAV and SNORT signatures — provide immediate detection value, particularly for any organisation with Linux systems or networking equipment running services on those ports. The longer-term implication is harder: as long as the world’s SOHO router population remains largely unmonitored and unpatched, ORB networks of this type remain cheap to build, difficult to disrupt, and increasingly available as a commodity service to any Chinese APT group that needs them.
UAT-7810’s LapDogs campaign is not a one-off operation. The presence of LEASHTEST, the version strings indicating active development, the structured malware architecture with distinct tools for different phases — this is sustained engineering investment in infrastructure that China’s intelligence apparatus clearly intends to use at scale.