Chinese Hackers Use LONGLEASH Malware to Target Ruckus Routers

— negativeImpact: 6.5/10

State-sponsored group UAT-7810 is deploying LONGLEASH malware to compromise unpatched Ruckus routers and expand their Operational Relay Box botnet.

Published 2h ago·2 min read·1 sources

·AI 100%

Human 0%

Compare Coverage· 2+ outlets needed

Chinese hacking group UAT-7810 has developed a new malware strain called LONGLEASH specifically designed to compromise internet-facing networking devices, according to BleepingComputer. The attackers are focusing their efforts on unpatched Ruckus wireless routers, using the malware to recruit these devices into an Operational Relay Box (ORB) network — a botnet infrastructure used for anonymizing malicious traffic.

The group's primary objective appears to be expanding the ORB network's reach, with Ruckus routers serving as the initial foothold. These devices are attractive targets due to their widespread deployment in enterprise and mesh network environments, combined with frequently delayed patching cycles. The campaign signals a shift from opportunistic scanning toward more targeted supply-chain exploitation.

Technical analysis reveals LONGLEASH establishes persistent access on affected routers, then communicates with command-and-control servers to receive further instructions. The malware likely exploits known vulnerabilities in older firmware versions, though BleepingComputer did not disclose specific CVE identifiers. Once compromised, the routers become relay nodes for routing malicious internet traffic, obscuring the source of attacks.

Mitigation remains limited to standard hygiene: administrators should immediately patch Ruckus routers to the latest firmware, disable remote management interfaces where possible, and monitor for unusual outbound connections. No vendor-specific advisory has been released addressing LONGLEASH directly. The group UAT-7810 has previously been associated with Chinese state-sponsored cyber espionage campaigns.

Attribution remains murky — while BleepingComputer links UAT-7810 to Chinese state sponsorship, independent threat intelligence firms may disagree on the group's precise affiliation. Broader implications suggest ORB networks are becoming critical infrastructure for advanced persistent threat (APT) groups seeking to evade geolocation-based detection.

◆ AI Agent Context

This brief is based solely on a single source (BleepingComputer) with high trust and relevance, published one hour ago. No corroborating reports or independent verification were available, limiting confidence in attribution claims. All technical details are derived directly from the source article without extrapolation. Confidence Notes: Confidence is lowered by the brief's reliance on a single source (BleepingComputer) for both the malware discovery and the attribution to Chinese state sponsorship, with no corroboration from independent threat intelligence vendors or detailed technical indicators of compromise (e.g., CVE identifiers or C2 domains). The lack of vendor advisories from Ruckus or CISA, combined with the absence of specific CVEs mentioned in the source article, suggests the threat may be based on unverified or outdated vulnerability disclosures. Additionally, the brief's mention of a 'shift toward targeted supply-chain exploitation' is not supported by evidence in the provided BleepingComputer article, which describes the campaign as leveraging known vulnerabilities in unpatched firmware, not supply-chain compromises.

// Counter-Argument

The attribution to Chinese state sponsorship is speculative, as UAT-7810's tools and tactics (e.g., ORB networks for traffic anonymization) overlap significantly with those of criminal ransomware groups and proxy services, which also target networking devices for profit. Without detailed infrastructure or intelligence linking the group to known state-sponsored APTs (e.g., APT41 or UNC3887), and given that BleepingComputer is the sole source of this claim, it is equally plausible that LONGLEASH is a reskinned version of commodity malware used by cybercriminal gangs seeking to sell relay access. Independent threat intelligence firms like Mandiant or CrowdStrike have not confirmed the attribution, and prior reports on ORB networks often tie them to Russian criminal groups (e.g., the 'Matanbuchus' botnet), not Chinese state actors.

Intelligence briefs are AI-generated from multiple sources for informational purposes only. Confidence scores, bias analysis, and consensus assessments reflect automated processing and may not capture all context. Verify critical information independently.

Chinese Hackers Use LONGLEASH Malware to Target Ruckus Routers

— negativeImpact: 6.5/10

State-sponsored group UAT-7810 is deploying LONGLEASH malware to compromise unpatched Ruckus routers and expand their Operational Relay Box botnet.

Published 2h ago·2 min read·1 sources

·AI 100%

Human 0%

Compare Coverage· 2+ outlets needed

◆ AI Agent Context

// Counter-Argument

Chinese Hackers Use LONGLEASH Malware to Target Ruckus Routers

// Source Consensus

// Key Events

// Entities

// Source Verification

Chinese Hackers Use LONGLEASH Malware to Target Ruckus Routers

// Source Consensus

// Key Events

// Entities

// Source Verification

// Takes & Comments

// Takes & Comments