ShortLeash
ShortLeash is a custom backdoor used in the China-nexus Operational Relay Box (ORB) network dubbed LapDogs. It is primarily deployed against Linux-based SOHO routers, IoT devices, and other edge systems, with observed concentration on Ruckus Wireless access points and Buffalo routers, and additional affected products from vendors including ASUS, Cisco-Linksys, D-Link, Microsoft, Panasonic, and Synology. SecurityScorecard reported LapDogs activity from at least September 2023, with infections concentrated in the United States, Japan, South Korea, Hong Kong, and Taiwan, and victims spanning IT, networking, media, real estate, and related sectors.
ShortLeash is used to maintain persistent, stealthy, long-term access on compromised devices and provides root-level access. It is assessed to be delivered primarily via shell script, with startup Bash-script execution requiring root privileges, environment checks for Ubuntu or CentOS, and persistence established by dropping a malicious systemd .service file so it survives reboot. Researchers also found artifacts indicating a Windows variant exists. Once active, ShortLeash sets up a fake Nginx web server and generates a unique self-signed TLS certificate per infected node with issuer metadata spoofing "LAPD," apparently impersonating the Los Angeles Police Department. These spoofed certificates were a key fingerprint used to track more than 1,000 infected nodes. The malware has also been described as creating encrypted backups and running as a background service.
Initial access in LapDogs intrusions was obtained by exploiting known N-day vulnerabilities in Linux-based devices, including CVE-2015-1548 and CVE-2017-17663, and the campaign also targeted devices with old and unpatched SSH services. SecurityScorecard reported infections were launched in coordinated batches, often up to 60 devices at a time, with shared port assignments suggesting centralized operator control. Forensic evidence including developer notes in Mandarin strongly supports attribution to a Chinese actor. SecurityScorecard assessed with medium confidence that the China-linked group UAT-5918 used LapDogs in at least one operation targeting Taiwan, although it remains unclear whether UAT-5918 operated the network or used it as a client. Published indicators associated with ShortLeash and LapDogs include spoofed TLS certificate fingerprints, C2 domains, and malware signatures.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"...infecting small office/home office (SOHO) routers with a custom backdoor named ShortLeash, which provides stealthy, long-term access to the compromised devices." | Most of the infected devices are Ruckus Wireless access points, followed by Buffalo Technology AirStation wireless routers. Running old and unpatched SSH services, they were found vulnerable to CVE-2015-1548 and CVE-2017-17663.
"The attacks themselves weaponize N-day security vulnerabilities (e.g., CVE-2015-1548 and CVE-2017-17663) to obtain initial access." | LapDogs' beating heart is a custom backdoor called ShortLeash that's engineered to enlist infected devices in the network.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
LapDogs leverages a custom backdoor ("ShortLeash") with unique self-signed TLS certificates mimicking LAPD metadata, focusing on Linux-based SOHO devices (notably Ruckus and Buffalo routers).
LapDogs leverages a custom backdoor ("ShortLeash") with unique self-signed TLS certificates mimicking LAPD metadata, focusing on Linux-based SOHO devices (notably Ruckus and Buffalo routers).
Forensic evidence such as developer notes written in Mandarin in a custom backdoor SecurityScorecard named "ShortLeash," plus tools, techniques and procedures "strongly supports" attribution to a Chinese actor.
Forensic evidence such as developer notes written in Mandarin in a custom backdoor SecurityScorecard named "ShortLeash," plus tools, techniques and procedures "strongly supports" attribution to a Chinese actor.
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ShortLeash is a backdoor malware deployed on compromised SOHO devices, such as routers and IoT devices, as part of a China-linked espionage campaign. Its specific capabilities are not fully detailed, but it is used to maintain long-term access to victim networks.
Custom backdoor used to enlist compromised SOHO/IoT and some Windows/VPS systems into the LapDogs ORB network; sets up a fake Nginx web server, generates a unique self-signed TLS certificate (issuer 'LAPD'), and persists via a .service file with root-level privileges on Linux-based devices.
Custom backdoor used by the LapDogs ORB network to maintain covert command-and-control and persistence on Linux-based SOHO devices, using unique self-signed TLS certificates and systemd-based persistence.
Custom backdoor used to maintain persistent access on compromised Linux-based SOHO devices within the LapDogs ORB network; generates unique self-signed TLS certificates with spoofed metadata per node to help masquerade infected nodes as legitimate devices and support C2/relay operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.