LapDogs

LapDogs is a China-nexus Operational Relay Box (ORB) network identified by SecurityScorecard’s STRIKE team and used to support prolonged cyber-espionage operations. It consists of more than 1,000 compromised nodes, primarily Linux-based SOHO and edge devices, and has been active since at least September 2023. Reported target geography includes the United States, Japan, South Korea, Hong Kong, Taiwan, and Southeast Asia. Affected sectors mentioned in the reporting include IT, networking, media, real estate, and municipal services. Reported affected device and service vendors include Ruckus Wireless, ASUS, Buffalo Technology, Cisco-Linksys, D-Link, Microsoft, Panasonic, and Synology, with Ruckus devices making up a large share of observed infections. LapDogs is powered by a custom backdoor called ShortLeash. ShortLeash provides persistent root-level access, establishes persistence via a .service/systemd service, sets up a fake Nginx web server, and generates unique self-signed TLS certificates per node with issuer metadata referencing “LAPD,” which SecurityScorecard assessed was intended to impersonate the Los Angeles Police Department. Initial access reportedly relies on exploitation of known vulnerabilities in older or unpatched devices, including CVE-2015-1548 and CVE-2017-17663. Researchers observed batch-style infections, often infecting no more than 60 devices at a time, and identified 162 distinct intrusion sets. SecurityScorecard assessed LapDogs with moderate confidence as linked to China-nexus actors and described it as relay infrastructure used to obfuscate operations rather than conduct direct attacks. Reporting states LapDogs shares some similarities with the separate China-linked ORB cluster PolarEdge, but the two were assessed as distinct due to different infection and persistence methods. SecurityScorecard also stated with medium confidence that the China-linked group UAT-5918 used LapDogs in at least one operation targeting Taiwan, but it remains unclear whether UAT-5918 operates LapDogs or is a client of the network. Known alias in the provided content: LapDogs.