LONGLEASH / SHORTLEASH ORB malware suite

Threat-actor developments this week: Group-IB reframes Scattered Spider as a decentralised collective, and China- and Iran-nexus edge/ORB tradecraft advances

The week's actor reporting split between a model-changing reframing of a well-known financially-motivated collective and a set of state-nexus tradecraft advances.

Scattered Spider — a model change, not an incident. Group-IB argues the actor "cannot be considered or analyzed as a single organized 'group' with its own hierarchy or organigram [but is] more accurately described as a decentralised cybercrime collective" of independent subclusters, typically 3-5 people, unified by shared tradecraft and community learning rather than command structure, and states "we can consider 0ktapus as a subcluster of Scattered Spider" — explicitly mapping Microsoft's Octo Tempest, Mandiant's UNC3944 and Palo Alto's Muddled Libra as overlapping labels for subclusters of the same movement (Group-IB, 2026-07-07). The documented playbook is squarely relevant to the constituency's help desks: vishing/smishing with Okta/Microsoft/Citrix/Google SSO-lookalike pages staged minutes before a call, SIM-swaps via coercion or carrier-staff social engineering, and help-desk impersonation using OSINT from already-compromised systems, monetised through BlackCat/ALPHV and DragonForce ransomware. The practical consequence Group-IB draws: because resilience comes from decentralisation, individual arrests do not blunt the collective, so defenders should treat each attributed intrusion as one small ad-hoc crew rather than evidence of a persistent central adversary.

State-nexus edge and C2 tradecraft. Talos detailed China-nexus UAT-7810 expanding its operational relay-box (ORB) network with the LONGLEASH/DOGLEASH/JARLEASH suite (Cisco Talos, 2026-07-08); Proofpoint's UNK_MassTraction, a suspected China-aligned actor, exploited Roundcube webmail as an edge device (Proofpoint, 2026-07-09); and Check Point exposed Iran MOIS-linked Cavern Manticore's modular .NET command-and-control framework with layered anti-analysis (Check Point Research, 2026-07-09).

Why grouped here: these are actor-model and capability developments — the lens the weekly owns — rather than new operational incidents. Scattered Spider's decentralisation and the state actors' edge/ORB focus both change how a SOC should scope attribution and where to look (help-desk identity workflows; internet-facing webmail and edge appliances as relay infrastructure).

Builds on: 2026-07-08/talos-uat-7810-china-nexus-orb-network-longleash · 2026-07-09/unk-masstraction-roundcube-edge-exploitation · 2026-07-09/cavern-manticore-iran-mois-modular-net-c2-anti-analysis

Cisco Talos: China-nexus UAT-7810 expands its ORB network with LONGLEASH/DOGLEASH/JARLEASH via unpatched Ruckus and ASUS routers

Cisco Talos profiled UAT-7810, a China-nexus actor Talos assesses with high confidence is tasked with building and maintaining Operational Relay Box (ORB) networks — relay/proxy infrastructure built from compromised networking gear that secondary China-nexus APTs use to launder the origin of operations against high-value targets (Cisco Talos, 2026-07-07). Talos names UAT-5918 — previously documented targeting Taiwanese critical infrastructure — as one such downstream consumer. Initial access is exploitation of known, unpatched vulnerabilities in Ruckus wireless routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717) and ASUS AiCloud routers (CVE-2025-2492), a tactic UAT-7810 has used since 2025 rather than a fresh zero-day (T1190). The malware suite, internally "ff-agent", now includes LONGLEASH — an enhanced successor to the SHORTLEASH backdoor adding reverse-shell and HTTP/DNS/SOCKS/TCP/ICMP/UDP multi-protocol proxying (T1090.003) — plus DOGLEASH, a passive C-based Linux backdoor, and JARLEASH, a Java-based admin tool for file management and FTP/SFTP access; it is built with Boost.Asio, custom protobuf encoding and MbedTLS TLS proxying, compiled for MIPS/ARM/x64, and self-deletes if tampering or a suspicious connection is detected (T1070).