A trio of newly named implants tied to a SOHO-router campaign shows how edge devices can be turned into reusable covert plumbing, not just one-time victim machines.
A China-linked cluster tracked by Cisco Talos is being tied to a newer implant, LONGLEASH, as part of a broader effort to grow an ORB network from internet-facing networking devices.
The malware’s value is no longer just access: its newer functions point to compromised infrastructure that can proxy traffic, relay commands, and widen the attacker’s control options.