Tracking UAT-7810: Advanced Persistent Threat Actor and Its Malware Arsenal
TL;DR
Cisco Talos has identified UAT-7810, an advanced persistent threat actor linked to the development of a sophisticated malware suite, including new variants SHORTLEASH and LONGLEASH. UAT-7810 primarily exploits unpatched vulnerabilities in Ruckus wireless routers and is suspected to support other threat actors.
Main Analysis
UAT-7810 is recognized for establishing Operational Relay Box networks that facilitate secondary attacks against high-value targets. Cisco Talos highlights the continuing evolution of UAT-7810’s malware capabilities, with particular emphasis on their custom-crafted programs, including the latest versions of SHORTLEASH and its enhanced variant LONGLEASH. LONGLEASH features a robust suite of components for command and control, exhibiting functionalities such as proxying, reverse shell capabilities, and the ability to operate as an intermediate server, facilitating more complex attacks.
Talos has noted two additional malware families in UAT-7810’s tools: DOGLEASH, a C-based backdoor deployed on Linux systems, and JARLEASH, a Java-based tool serving administrative functions. DOGLEASH allows for arbitrary command execution on compromised devices by modifying system settings to permit incoming traffic, whereas JARLEASH provides a file management interface and is coupled with a script for seamless startup.
Furthermore, UAT-7810’s exploitation strategy involves targeting specific n-day vulnerabilities in Ruckus wireless routers, which underscores the importance of addressing known flaws in deployed hardware. The discovery of infrastructure behind UAT-7810, including several compromised servers used for payload hosting, points to an organized and persistent campaign.
Defensive Context
Realistically, organizations with Ruckus infrastructure or similar devices are at heightened risk, especially if they have not applied pertinent updates. The sophisticated nature of UAT-7810’s malware indicates that typical defenses may be insufficient against such persistent threats, necessitating a tailored approach focused on specific detection and response strategies.
Why This Matters
The operational tactics of UAT-7810 demonstrate significant risks, particularly for sectors heavily reliant on wireless infrastructure that could be targeted for exploitation. Organizations should particularly focus on vulnerable devices to mitigate risks associated with compromise.
Environment Exposure
Exposure to UAT-7810 is relevant when operational devices remain unpatched against known vulnerabilities. Environments not using affected hardware, or those that apply security updates promptly, are less likely to be impacted. Additionally, the complexity of the threat actors and their tools makes advanced defensive measures essential.
Indicators of Compromise (IOCs)
Cisco Talos has provided several relevant IOCs as follows:
- IP addresses: 194.233.92[.]26, 217.15.160[.]247, 217.15.164[.]147, 95.182.100[.]231
- Malware hashes:
- LONGLEASH: 755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d518a08e0626aa4f
- DOGLEASH: 604b53f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52ab1f13
This intelligence reflects ongoing and evolving threats in the landscape of cybersecurity, necessitating vigilance among affected sectors.
