Chinese hackers expand ORB network with new LONGLEASH backdoor

Security researchers have observed activity by a hacking group tracked as UAT-7810 and linked to China. The threat actors are developing their own malware, LONGLEASH, designed to expand their Operational Relay Box (ORB) network.

How the attack works

The group's primary targets are internet-facing network devices. First and foremost, the attackers exploit unpatched Ruckus routers, compromising them to enroll them into the ORB network.

ORB networks are infrastructures made up of compromised devices that hacking groups use as intermediate nodes to disguise the origin of their attacks and to build anonymous communication channels for subsequent operations.

Evolving toolset

According to the researchers, UAT-7810 is not resting on its laurels and continues to refine the LONGLEASH malware, which points to a methodical, deliberate expansion of the infrastructure under its control.

Using vulnerable network devices as a foothold allows the group to scale up its ORB network without having to commit its own resources, and it also complicates the attribution of subsequent attacks carried out through the compromised nodes.

Experts advise administrators of network equipment, and Ruckus router owners in particular, to install security updates promptly in order to reduce the risk of their devices being enrolled in networks like this.

Source: Bleeping Computer