THREAT OPS › Threat News › UAT-7810 continues building ORB networks using new malware
UAT-7810 continues building ORB networks using new malware
<ul><li>Cisco Talos is actively tracking infrastructure and malware associated with UAT-7810, an advanced persistent threat (APT) actor responsible for maintaining and proliferating the <a href="https://securityscorecard.com/wp-content/uploads/2025/06/LapDogs-STRIKE-Report-June-2025.pdf">LapDogs</a> Operational Relay Box (ORB) network, first disclosed by SecurityScorecard in 2025.</li><li>UAT-7810
MITRE ATT&CK techniques
Indicators of compromise
- c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15sha256
- 1b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd8823sha256
- 755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d518a08e0626aa4fsha256
- e799d72929d7ccc7f6b6109742b8cc482838303207efc989543b6e1ca6d16e9csha256
- 3b89d183eb014e29d9d0d4e45fc2b784a7fcfcf31dd48fd3bde30f8d956383d1sha256
- 324d95024fc8da5c92b5a1f4825aed5a2a91c9ca8fb6aa52abb332a4c9cf4257sha256
- bafba443170e54ef7fd431ce7f1b5e202719f3fd022e4ef70788904f574d2cdfsha256
- 604b53f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52ab1f13sha256
- c92541f273eeb576d39235d0a5c6f18f2574b132a1022598edfa38065783ab98sha256
- 29c7fccc6ef8cbfe4da9a169c7c74bacaea1fb515a1fddef91ab1b1522f76e4csha256
- 425bf771c8c9f740b1ae9803dcb4fd45af4d6a6f171fcc72fc7d511095ca82cesha256
- ac8eae94d27122f4751bc96d9ea52d30000b7ca37569a2291b2710824ca3396fsha256
- dc4f25b2247cfdd6fc96848db30a178baa4419a4c854e86e315b465836102d14sha256
- 3878dd5c8eba1e5b53ab2e07e7b5482e95a3fd3e98268bcd7861318bc9902376sha256
- 9b9e0e5a1eb469b8d20dc23351e08ff5d5731e1cedce0ddee9bbd00a76217f13sha256
- 57bdab2ba4b05ec0338c06632599393d5b14227f31a43fe950ea8fdd47428715sha256
- b8d247fd1fb85d24a17afeec3815906dfbcdc5359647910b4a153900ec999a0fsha256
- 5e225ea2648a8cba0fd94ec7fd8ce5315f5d0cc2922bafc9db3c8c41280e917csha256
- d5cf7315186a78ab6a7475c338bdf101bc6461930aaa7a012a02cf93f347c207sha256
- dd0fc1a88180fde8367bec7086f99294f36b8332f12994293139ed532d2ebbacsha256
- 5c3f190571645c4641dcff2c07a4c3ab9acad06aa9607350a385729d8d6139f1sha256
- 323c3a91be60ebc3e06e942bad04899a15911cea23269e43d07829164b2ce5d4sha256
- 880425fee707e9f42e0b8d60119ed639b1ad506ea29877d126bdebce379cd229sha256
- e5d2de8ae98579bfb940290f60e59a502b3065345aaf765456387989c0488b20sha256
- 2e0e43776e2e1a37d882a1b2ebb7d337ee88950177e43831dae645a367824febsha256
- b5969636eec376ad6c3ece2202b1722219955638e09b6f96d4cfc0598d3b1890sha256
- 1660536f448b8b9f086ce9ea3ce4e9deefc59a76711ea53ee6d8f08fc8c1bb99sha256
- 65feba2c971c214e71303ad2e0fbf62b45ebcaa784cbf3d0dab62786cb4c0469sha256
- 53ac2b231c23d41234e55b1f7ed89f86234f785adbbe820959655d7b019d7df9sha256
- 33c10b77e1da9f0679023d55fb3057879d15609db9c1d46ee5c3ff1240a3d052sha256
- 5faea1650cac0f3ffd2dc1fb220182095a46e34158967d37c2a942e85e2ca97bsha256
- 62d4ec87ed21f0d15cb769b0b2a5577cab41fc2cdb1e7e796c5bdff09264dd9asha256
- 534a4a5bff2609a2d6e088cb87465c08c2d69c6aaa7d2ffcbcd491274b8505f1sha256
- 5eab4c61baa67ae2838a36c2e6ff0476a8f2117b96a7027b830c8cb46ce78efcsha256
- 0af4c52a1d13e4132a1843ce7727abcf0ddd4d1ca6a4b17cdf599ec3f355c241sha256
- d4861088161fc72b9922abf933b4ea664a807105ec1eab4a173253aa60bfe6d7sha256
- 3d296af7f29c0425655bd1cc0be48fe4aba52ee6760a89e805ca2589f4ef4d77sha256
- f235d2e044c2f7814e6bbcd835b9fd9f10f227dacfb9396185ec2013e7df4db4sha256
- 4130f49fa81a699a667cafdbd6d1f6e781edd686c947eb8ae27134f6dc2c43d7sha256
- 0a8555a71868749be8c905ed53296ce335af50a9262772b5e154ad3f9c35c2e4sha256
Original source: https://blog.talosintelligence.com/uat-7810/