LapDogs-STRIKE-Report-June-2025.pdf

LapDogs, The

New ORB in Town

Executive Summary

SecurityScorecard’s STRIKE research team has identified a new suspected China-Nexus network of Operational Relay Boxes (ORB) called “LapDogs” targeting primarily Linux-based Small Office/Home Office (SOHO) devices around the globe. The LapDogs network has a high concentration of victims across the United States and Southeast Asia, and is slowly but steadily growing in size.

LapDogs employs a custom backdoor we named "ShortLeash," which establishes a foothold on compromised devices and connects them within the network. ShortLeash generates unique, self-signed TLS certificates with spoofed metadata for each node.

Our analysis traces these certificates to over 1,000 actively infected nodes globally, revealin…