Signal
China-linked APT UAT-7810 expands malware arsenal targeting network devices
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-07-08 09:04 UTCUpdated 2026-07-08 15:42 UTC
rss
cveexploitsmalwarethreat_actorssecurity_tooling
Trend in the last 24h
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (3 domains)domains are deduped. counts indicate coverage, not truth.3 top sources shown
Overview
The Chinese advanced persistent threat group UAT-7810 is actively expanding its Operational Relay Box (ORB) proxy network by deploying new malware targeting internet-facing SOHO routers and networking devices.
Score total
1.29
Momentum 24h
3
Posts
3
Origins
3
Source types
1
Duplicate ratio
0%
Why now
- Recent Cisco Talos findings reveal active deployment of new malware by UAT-7810.
- The expansion of the ORB network signals ongoing and evolving cyber espionage campaigns.
- Early awareness aids organizations in mitigating risks from emerging backdoor variants.
Why it matters
- UAT-7810’s expanded malware arsenal increases risks to internet-facing network devices globally.
- New backdoors targeting SOHO routers enable stealthy proxy operations and persistent access.
- Understanding this threat helps defenders prioritize protections for critical network infrastructure.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- UAT-7810 is expanding its proxy relay network with new backdoors targeting SOHO routers and networking devices.
How sources frame it
- Cisco Talos: neutral
Consolidated multiple reports to highlight the evolving malware capabilities of UAT-7810 targeting network devices.
All evidence
All evidence
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors
SecurityWeek · securityweek.com · 2026-07-08 15:42 UTC
China-Linked APT Expands Proxy Network With New Malware
Infosecurity Magazine · infosecurity-magazine.com · 2026-07-08 14:30 UTC
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
thehackernews · thehackernews.com · 2026-07-08 09:04 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 3Origin domains: 3Duplicates: -
Showing 3 / 0
Top publishers (this list)
- SecurityWeek (1)
- Infosecurity Magazine (1)
- thehackernews (1)
Top origin domains (this list)
- securityweek.com (1)
- infosecurity-magazine.com (1)
- thehackernews.com (1)