A China-linked cluster tracked by Cisco Talos is being tied to a newer implant, LONGLEASH, as part of a broader effort to grow an ORB network from internet-facing networking devices.
The malware’s value is no longer just access: its newer functions point to compromised infrastructure that can proxy traffic, relay commands, and widen the attacker’s control options.