Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team.

This week, Cisco Talos details UAT-7810, a China-nexus group whose likely job is standing up the relay networks other espionage crews use to strike their targets, and whose own arsenal now includes a newer version of its SHORTLEASH backdoor plus two previously unknown malware families.

China-nexus UAT-7810 builds fresh relay networks with new malware →

Brief: Cisco Talos is tracking UAT-7810, an advanced persistent threat (APT) group assessed with high confidence to be China-nexus, and which sustains the LapDogs Operational Relay Box (ORB) network that SecurityScorecard first documented in 2025.

Intel: Talos assesses the actor's likely job is to stand up ORB networks, a type of covert network that secondary threat actors like UAT-5918 borrow to strike high-value targets. The actor primarily exploits known vulnerabilities (n-days) in unpatched Ruckus wireless routers (CVE-2020-22653, CVE-2020-22658, CVE-2023-25717), and one server associated with UAT-7810 infrastructure was also used against ASUS AiCloud routers (CVE-2025-2492) in early 2026. Researchers found a newer version of its SHORTLEASH backdoor, tracked as LONGLEASH, plus two previously unknown families, the C-based DOGLEASH and the Java-based JARLEASH, whose configuration file carries comments in Simplified Chinese.

Why it matters: Espionage here runs on a division of labor: one crew builds the relay layer, the operators who break in borrow it. LONGLEASH can act as an intermediate command and control (C2), so each compromised edge device becomes another rung of the network. LEASHTEST, a leftover test binary, shows the crew still validating its tooling after shipping LONGLEASH.

Microsoft tells customers to expect higher volume of fixes from AI →

Brief: Microsoft told Windows customers to expect more fixes in each monthly release as AI accelerates how fast it finds vulnerabilities in its own code.

Intel: In a July 9 post, Pavan Davuluri, Microsoft's EVP of Windows and Devices, wrote that "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release." Driving the increase is a multi-model agentic scanning harness (MDASH) that runs candidate flaws through debate across several AI model families before a separate pipeline strips false positives. Microsoft is also revising its Secure Development Lifecycle (SDL) for AI-enabled attack techniques and applying AI to move flaws through remediation faster, with humans kept in the loop for code review.

On Tuesday, Microsoft released its July Patch Tuesday, addressing 569 CVEs, the largest release in Patch Tuesday history and nearly triple the previous record of 198 set in June. We break down the full release in our monthly Patch Tuesday blog.

Why it matters: The research itself hasn't changed. The engine finding the flaws has. As the same tooling scales across vendors, the monthly cycle grows heavier by design, and the burden of testing and deploying that rising volume settles on the customers running the software.

A vibe-coded script mapped Active Directory in a real breach →

Brief: Huntress recovered a PowerShell script (a Windows scripting tool) that an attacker used during a June 3 intrusion to map an Active Directory (AD) environment, and its contents show it was built through "vibe coding," prompting AI in natural language until the output works.

Intel: The attacker gained remote desktop protocol (RDP) access using pre-compromised credentials, staged tools in C:\ProgramData, a Windows system folder, then ran the script before using legitimate binaries to exfiltrate data. Huntress rebuilt it from telemetry and found the AI's fingerprints: a title reading "100% Working AD Information Gathering Script - FULLY FIXED," an unedited example server name the operator never replaced, five redundant ways to locate a domain controller, and an auto-generated HTML report summarizing the theft.

Why it matters: Vibe coding puts bespoke, single-use tooling in the hands of a mediocre actor, and no two of its scripts look alike. What does not change is the tradecraft: the Active Directory enumeration underneath behaves the same way on the operating system no matter who prompted it, and that behavior is what detection can still read.

Iran-nexus Cavern Manticore hides its C2 across three .NET formats →

Brief: Check Point Research uncovered an Iran-nexus advanced persistent threat (APT) group it tracks as Cavern Manticore, running a modular C2 framework against Israeli government and IT-sector organizations.

Intel: Already inside its targets, the group abuses a legitimate software-deployment feature, in one case SysAid's update mechanism, to drop a malicious dynamic link library (DLL) beside a trusted program (WinDirStat) that loads it and launches the Cavern backdoor. Its standout move is architectural: one .NET framework built three separate ways, forcing analysts into a different set of analysis tools for each component, while most samples evade nearly all antivirus detection. Check Point links the group to Iran's Ministry of Intelligence and Security (MOIS) and notes technical overlaps with MuddyWater and Lyceum, a subgroup of OilRig.

Why it matters: None of this needed a new exploit. The intrusion runs on the target's own trusted software and on ordinary .NET compilation choices, and each module unloads itself from memory after it runs, leaving little on disk to scan. The near-invisibility is assembled almost entirely from legitimate parts.

Stat of the week: 5,811

The number of arrests across 97 countries in Operation First Light 2026, a crackdown on social engineering scams and money laundering that also intercepted USD 293 million in illicit assets, according to Interpol.

Tenable’s RSO serves as Tenable’s Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.