CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

UAT-5918

actor · actor:uat-5918 single-source

China-nexus APT previously documented by Cisco Talos targeting critical infrastructure in Taiwan; named (Talos, 2026-07-07) as a secondary consumer of UAT-7810's ORB relay-network infrastructure.

Coverage
1
first 2026-07-08 → last 2026-07-08
Latest activity
2026-07-08
Talos: China-nexus UAT-7810 builds ORB relay networks from unpatched Ruckus/ASUS routers for secondary APTs
Peak priority
notable
1 notable
Targets
telco
sectors: telco, public-sector · regions: apac
Sources cited
1
1 hosts

Action items (2)

Do-now tasks recorded on the entries about UAT-5918, newest first. Check the date before acting on an older one.

Defender insights

What each entry about UAT-5918 tells a defender to do, newest first.

2026-07-08NOTABLETalos: China-nexus UAT-7810 builds ORB relay networks from unpatched Ruckus/ASUS routers for secondary APTs

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

collaborates with

Story timeline

  1. 2026-07-08Cisco Talos: China-nexus UAT-7810 expands its ORB network with LONGLEASH/DOGLEASH/JARLEASH via unpatched Ruckus and ASUS routers
    active-threatsTalos: China-nexus UAT-7810 builds ORB relay networks from unpatched Ruckus/ASUS routers for secondary APTs

Hunting pivots

Tags
botnetchina-nexusespionagenation-state
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • StealthIndicator Removal
  • Command and ControlProxy: Multi-hop Proxy

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-08/talos-uat-7810-china-nexus-orb-network-longleash · ATT&CK page ↗

Stealth TA0005

T1070Indicator Removal×1

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Evidence: 2026-07-08/talos-uat-7810-china-nexus-orb-network-longleash · ATT&CK page ↗

Command and Control TA0011

T1090.003Proxy: Multi-hop Proxy×1

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

Evidence: 2026-07-08/talos-uat-7810-china-nexus-orb-network-longleash · ATT&CK page ↗

Entries about UAT-5918 (1)

2026-07-08 · view entry permalink →

NOTABLENATOB2

Cisco Talos: China-nexus UAT-7810 expands its ORB network with LONGLEASH/DOGLEASH/JARLEASH via unpatched Ruckus and ASUS routers

Cisco Talos profiled UAT-7810, a China-nexus actor Talos assesses with high confidence is tasked with building and maintaining Operational Relay Box (ORB) networks, relay/proxy infrastructure built from compromised networking gear that secondary China-nexus APTs use to launder the origin of operations against high-value targets (Cisco Talos, 2026-07-07). Talos names UAT-5918 (previously documented targeting Taiwanese critical infrastructure) as one such downstream consumer. Initial access is exploitation of known, unpatched vulnerabilities in Ruckus wireless routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717) and ASUS AiCloud routers (CVE-2025-2492), a tactic UAT-7810 has used since 2025 rather than a fresh zero-day (T1190). The malware suite, internally "ff-agent", now includes LONGLEASH, an enhanced successor to the SHORTLEASH backdoor adding reverse-shell and HTTP/DNS/SOCKS/TCP/ICMP/UDP multi-protocol proxying (T1090.003), plus DOGLEASH, a passive C-based Linux backdoor, and JARLEASH, a Java-based admin tool for file management and FTP/SFTP access; it is built with Boost.Asio, custom protobuf encoding and MbedTLS TLS proxying, compiled for MIPS/ARM/x64, and self-deletes if tampering or a suspicious connection is detected (T1070).

Talos assesses with high confidence that UAT-7810 is a China-nexus threat actor based on the infrastructure that it provides to secondary China-nexus APTs such as UAT-5918.

Talos has observed UAT-7810 primarily exploit known vulnerabilities in unpatched Ruckus wireless routers, a tactic UAT-7810 has used since 2025.

Cisco Talos 2026-07-07
threat08 Jul 20:35Zsingle-sourceOpen finding →
Sources: Cisco Talos

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • blog.talosintelligence.com1 (100%)
All cited sources (1)