RST TI Report Digest: 13 Jul 2026

Cisco Talos reports that UAT-7810, a China-nexus APT, is building Operational Relay Box (ORB) networks and expanding its malware toolkit (LONGLEASH, updated SHORTLEASH, DOGLEASH, JARLEASH) to support secondary actors; the campaign exploits unpatched devices including Ruckus routers and CVE-2025-2492, targets multiple CPU architectures, shows overlap with UAT-5918, and includes extensive IOCs (IPs, URLs, and numerous SHA-256 hashes).