LapDogs
LapDogs is a malware/operational relay box (ORB) network first identified in 2025 and described as China-linked. It primarily targets Linux-based SOHO edge devices, including routers such as Ruckus and Buffalo models, with targeting focused on the United States and Southeast Asia; additional referenced targeting includes Taiwan, Japan, South Korea, and Hong Kong. LapDogs uses a custom Linux backdoor named ShortLeash and maintains covert command-and-control through unique self-signed TLS certificates generated per node that mimic LAPD metadata. Persistence is described as using root-privileged systemd service files. The activity is characterized as supporting covert relay infrastructure and cyber espionage rather than conventional botnet use, and the content links LapDogs to the espionage actor UAT-5918 as referenced by Cisco Talos. High-confidence identifiers mentioned in the content include the ShortLeash backdoor and the distinctive LAPD-mimicking self-signed TLS certificates.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
"It leverages the proprietary AiCloud service with n-day vulnerabilities in order to gain high privileges on End-Of-Life ASUS WRT routers" ... "The attacks likely exploit vulnerabilities tracked as CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492 for proliferation."
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A router-focused ORB-style malware/network that compromises devices via n-day vulnerabilities to build relay and scanning infrastructure.
Named ORB campaign targeting routers (no additional technical details provided in the content).
China-linked ORB network leveraging a custom backdoor (ShortLeash) to compromise Linux-based SOHO devices for persistent espionage, using unique TLS certificates for covert C2.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.