New LONGLEASH Malware Expands Chinese Hackers' ORB Network

Emily Davis · 2026-07-07

Chinese hackers tracked as 'UAT-7810' are stepping up their game, evolving a new malware strain called LONGLEASH to grow their Operational Relay Box (ORB) network. They're targeting internet-facing networking devices, especially unpatched Ruckus routers, to build a hidden infrastructure for cyberattacks. This isn't just another malware story. It's a wake-up call for anyone relying on networking gear to keep their operations safe. Let's break down what's happening and how you can protect yourself. ### What is the ORB Network? An Operational Relay Box (ORB) network is like a secret relay system. Hackers compromise devices—routers, firewalls, or switches—to act as middlemen. These boxes hide the hackers' true location and make their attacks harder to trace. Think of it as a series of anonymous checkpoints for data traffic. With LONGLEASH, UAT-7810 is expanding this network by infecting vulnerable Ruckus routers. Once inside, the malware gives hackers remote control, turning each device into a stepping stone for future attacks. ### How Does LONGLEASH Work? LONGLEASH is designed to be stealthy and persistent. Here's a simplified look at its process: - **Initial Access:** It scans for unpatched Ruckus routers with known vulnerabilities. - **Installation:** Once in, it drops the malware without triggering alarms. - **Persistence:** It sets up backdoors to survive reboots or firmware updates. - **Relay Function:** The infected device becomes part of the ORB network, forwarding traffic for the hackers. This approach lets UAT-7810 stay under the radar while building a massive, distributed attack infrastructure. ### Why Target Ruckus Routers? Ruckus routers are popular in businesses, schools, and public Wi-Fi hotspots. They're powerful but often neglected when it comes to patching. Hackers love this. By focusing on unpatched devices, UAT-7810 exploits a common weakness: outdated firmware. If you're using a Ruckus router, check for updates now. A single unpatched flaw could turn your network into a hacker's tool. ### The Bigger Picture for Professionals For professionals in antidetect browsers and digital privacy, this news hits close to home. ORB networks are used to bypass location restrictions, hide malicious activity, and launch attacks that are hard to block. Understanding how they grow is key to defending against them. Antidetect browsers can help you spot unusual traffic patterns or device behaviors. But hardware security is just as critical. Your networking devices are the front line. ### How to Protect Yourself Here are practical steps to defend against threats like LONGLEASH: - **Patch Regularly:** Update firmware on all networking devices monthly. - **Change Default Credentials:** Hackers scan for weak passwords. - **Monitor Traffic:** Use tools to detect odd outbound connections. - **Segment Networks:** Keep critical systems separate from public-facing ones. - **Use Antidetect Browsers:** They add a layer of anonymity and can flag suspicious activity. ### A Quick Reality Check "Cybercriminals don't just target computers anymore. They go after the pipes that connect them." That's a quote from a security researcher I respect. It's true. Your router is a goldmine for hackers if left unsecured. Don't wait for a breach to take action. The LONGLEASH malware is a reminder that vigilance pays off. ### Final Thoughts The evolution of UAT-7810's malware shows how persistent cyber threats are. For antidetect browser users and privacy pros, staying ahead means locking down every entry point. Your devices are only as strong as their weakest link. Stay updated, stay curious, and keep your network tight. That's the best defense against hidden threats like LONGLEASH.