LONGLEASH malware is the latest example of how state-linked operators are quietly turning compromised network gear into durable infrastructure. According to the report, Chinese hackers tracked as UAT-7810 are evolving their toolkit to expand an Operational Relay Box (ORB) network by targeting internet-facing devices, especially unpatched Ruckus routers.
For security leaders, the risk is not just another malware family. The LONGLEASH malware campaign shows how attackers can use vulnerable edge devices as relay points, hide command-and-control traffic, and make attribution more difficult. In practice, that means compromised routers can become part of a larger covert network used for persistence, access, and operational concealment.
LONGLEASH malware and the ORB network model
ORB networks are built to blend malicious traffic into normal-looking network paths. Instead of relying on a single server or domain, operators route activity through layers of compromised devices. As a result, defenders see traffic that appears fragmented, distributed, and harder to correlate.
LONGLEASH malware appears designed to support this model by adding more relay nodes. That approach increases resilience for the attacker and reduces the effectiveness of simple IP blocking. In other words, taking down one relay does not disrupt the full network.
Why unpatched routers are a high-value target
Internet-facing routers and networking appliances often sit outside traditional endpoint visibility. They may not run EDR, and they are frequently overlooked in patch cycles. Therefore, when a device like a Ruckus router remains unpatched, it becomes an ideal foothold for operators looking to extend infrastructure quietly.
Once compromised, these devices can be used for traffic relay, lateral staging, DNS manipulation, or redirection of operator communications. Moreover, because edge devices are trusted by design, malicious activity may bypass many controls that are effective on endpoints and servers.
What defenders should monitor for LONGLEASH malware
Security teams should treat edge-device visibility as a priority. Start by inventorying all exposed routers, firewalls, and networking appliances, then verify firmware status and support lifecycle. In addition, review whether management interfaces are publicly reachable and whether MFA, segmentation, and access restrictions are in place.
Detection should focus on abnormal outbound connections, unusual DNS behavior, unexpected configuration changes, and traffic patterns that do not match the device’s role. Similarly, log collection from network devices should be centralized so analysts can correlate anomalies with broader threat activity. If the environment includes Splunk, this is where strong telemetry normalization and correlation can help surface hidden relay behavior faster.
Reducing exposure to ORB-style campaigns
To reduce risk from LONGLEASH malware and similar campaigns, organizations need layered controls around the edge. Patch quickly, disable unused services, and replace unsupported hardware before it becomes a permanent liability. Just as importantly, build a process for continuous exposure management across all internet-facing assets.
Finally, assume that edge-device compromise can be stealthier than endpoint intrusion. Use threat hunting to look for persistence, unexpected admin activity, and outbound beaconing from devices that should remain quiet. The more distributed the environment, the more important it is to detect small anomalies before they become part of a larger relay network.
Truventura helps enterprises strengthen detection, visibility, and response across complex environments. If you want to assess your exposure to edge-device compromise, improve monitoring maturity, or build stronger cybersecurity governance, explore Truventura’s cybersecurity advisory services at truventura.com/services.