Loading malware…
LapDogs is a China-nexus operational relay box network centered on the compromise of internet-facing Linux-based SOHO and edge networking devices, particularly routers. It is associated with the threat actor UAT-7810, which has been assessed as responsible for maintaining and expanding the infrastructure, likely for use by other China-aligned intrusion actors including UAT-5918. The network emerged publicly in 2025 and has been linked to activity focused on the United States and Southeast Asia.
LapDogs relies on a bespoke Linux backdoor family known as ShortLeash, with later evolution into LONGLEASH, reflecting active development. ShortLeash supports covert command-and-control, can host a web server on a compromised device, and can function as both a command-and-control client and server. LONGLEASH extends this design with relay and proxy capabilities over multiple protocols, allowing compromised nodes to operate as intermediate command-and-control infrastructure that forwards commands and data between upstream controllers and peer nodes. Reported companion tooling includes DOGLEASH, a passive backdoor capable of executing arbitrary shellcode on compromised Linux devices; LEASHTEST, used to validate functionality on MIPS-based embedded systems; and JARLEASH, a Java-based administration backdoor supporting file management and remote transfer functions.
The malware ecosystem is used to convert compromised routers and similar devices into covert relay infrastructure that obscures backend operator systems and supports follow-on espionage operations. Persistence has been observed through privileged service configuration on Linux systems, and the operators have used unique self-signed TLS certificates designed to blend in with expected metadata. LONGLEASH also includes anti-tampering behavior, including the ability to remove the implant and traces if interference is detected.
Observed intrusion activity tied to LapDogs has exploited known vulnerabilities in unpatched Ruckus devices, and related campaigns have also targeted ASUS AiCloud routers to broaden the relay network. The overall role of LapDogs is not conventional disruptive botnet activity, but stealthy post-compromise infrastructure support: maintaining persistent access, relaying traffic, and enabling covert command-and-control for broader China-linked espionage operations.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
UAT-7810 exploited CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717 to compromise Ruckus devices and expand the LapDogs operational relay box network.
UAT-7810 is an advanced persistent threat (APT) actor that's responsible for maintaining and proliferating LapDogs, an ORB network that first came to light in June 2025.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
"It leverages the proprietary AiCloud service with n-day vulnerabilities in order to gain high privileges on End-Of-Life ASUS WRT routers" ... "The attacks likely exploit vulnerabilities tracked as CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492 for proliferation."
In both the Dysphoria and UAT-7810 campaigns, compromised devices were repurposed as relay infrastructure after initial access. Dysphoria used infected hosts to proxy traffic and obscure backend C2 infrastructure, while UAT-7810 expanded the LapDogs ORB network.
111 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.