Over 1,000 SOHO Devices Compromised in Cyber Espionage Campaign Linked to China
On June 27, 2025, cybersecurity experts reported the discovery of a significant network of more than 1,000 small office and home office (SOHO) devices that have been compromised for cyber espionage activities attributed to hacking groups with links to China. This extensive cyber infrastructure, named the Operational Relay Box (ORB) network, has been dubbed “LapDogs” by the STRIKE team at SecurityScorecard.
The report highlights a concerning trend: the LapDogs network has shown a marked concentration of victims primarily located in the United States and Southeast Asia, while its footprint continues to expand steadily. Other regions affected include Japan, South Korea, Hong Kong, and Taiwan, with victims spanning several industries such as information technology, networking, real estate, and media.
The compromised devices include well-known brands like Ruckus Wireless, ASUS, Buffalo Technology, Cisco-Linksys, Cross DVR, D-Link, Microsoft, Panasonic, and Synology. Such a diverse array of hardware underscores the far-reaching implications of this cyber threat. Central to the operation is a custom backdoor referred to as ShortLeash, designed to maintain persistent access to the infected systems.
In terms of the tactics employed in this attack, a framework such as the MITRE ATT&CK Matrix offers valuable insights. Potential strategies could include initial access through exploiting unpatched vulnerabilities in the targeted devices, followed by establishing persistence via the ShortLeash backdoor. The attackers may have also engaged in privilege escalation to gain higher levels of access, thereby enabling broader control over the systems.
Security professionals advise business owners to remain vigilant in light of these findings. The widespread nature of the infection highlights an urgent need for enhanced cybersecurity measures, including regular updates and monitoring of SOHO devices, which often lack the level of protection afforded to larger enterprise networks.
As this campaign continues to unfold, it is crucial for organizations to educate themselves on the signs of compromise and to implement robust security protocols. The LapDogs network exemplifies the persistent and evolving threats faced by businesses today, making it imperative to stay informed and proactive in safeguarding against such cyber risks.
