China-linked LapDogs Campaign Drops ShortLeash Backdoor with Fake Certs

Stealthy backdoor found hiding in SOHO devices running Linux

Researchers uncovered a network of compromised small office and home office (SOHO) devices they’re calling LapDogs. The threat is part of a broader shift in how China-Nexus threat actors are using Operational Relay Box (ORB) networks to hide their operations. At the center of the operation is a custom backdoor called ShortLeash, which gives attackers root-level access and ensures persistence. Once installed, it sets up a fake Nginx web server an…

China-linked LapDogs Campaign Drops ShortLeash Backdoor with Fake Certs

ShortLeash backdoor, used in the China-linked LapDogs campaign since 2023, enables stealth access, persistence, and data theft via compromised SOHO routers and fake certs.