News
- ShortLeash gives hackers root-level stealth and blends malicious activity into everyday network traffic
- LapDogs uses fake LAPD certificates to disguise malware, bypassing even the best endpoint protection systems
- The malware quietly hijacks routers and devices that often go unmonitored for months
A recently disclosed cyber espionage operation, dubbed LapDogs, has drawn scrutiny following revelations from SecurityScorecard’s Strike Team.
The operation, believed to be conducted by China-aligned threat actors, has quietly infiltrated over 1,000 devices across the United States, Japan, South Korea, Taiwan, and Hong Kong.
What makes this campaign distinctive is its use of hijacked SOHO routers and IoT hardware, transforming them into Operational Relay Boxes (ORBs) for sustained surveillance.
Stealth, persistence, and false identitiesLapDogs is an ongoing campaign, active since September 2023, targeting real estate, media, municipal, and IT sectors.
Devices from known vendors such as Buffalo Technology and Ruckus Wireless have reportedly been compromised.
The attackers use a custom backdoor named ShortLeash, which grants extensive privileges and stealth, allowing them to blend in with legitimate traffic.
According to the report, once a device is infected, it may go undetected for months, and in worst-case scenarios, some are used as gateways to infiltrate internal networks.
Unlike typical botnets that prioritize disruption or spam, LapDogs reveals a more surgical approach.
“LapDogs reflects a strategic shift in how cyber threat actors are leveraging distributed, low-visibility devices to gain persistent access,” said Ryan Sherstobitoff, Chief Threat Intelligence Officer at SecurityScorecard.
“These aren’t opportunistic smash-and-grab attacks—these are deliberate, geo-targeted campaigns that erode the value of traditional IOCs (Indicators of Compromise).”
With 162 distinct intrusion sets already mapped, the structure of the operation suggests clear intent and segmentation.
What is especially unsettling is the spoofing of legitimate security credentials.
The malware fabricates TLS certificates appearing to be signed by the Los Angeles Police Department.
This forgery, combined with geolocation-aware certificate issuance and assigned ports, makes it extremely difficult for conventional detection systems to flag malicious behavior.
Even the best endpoint protection tools would be challenged in spotting such well-disguised intrusions, especially when activity is routed through compromised home routers rather than enterprise assets.
SecurityScorecard compares LapDogs with PolarEdge, another China-linked ORB system, but emphasizes that the two are distinct in infrastructure and execution.
The broader concern raised is the expanding vulnerability landscape. As businesses rely more on decentralized devices and fail to update embedded firmware, the risk of persistent espionage increases.
The report calls on network defenders and ISPs to review devices across their supply chains.
SecurityScorecard compares LapDogs with PolarEdge, another China-linked ORB system, but emphasizes that the two are distinct in infrastructure and execution.
The broader concern raised is the expanding vulnerability landscape. As businesses rely more on decentralized devices and fail to update embedded firmware, the risk of persistent espionage increases.
The report calls on network defenders and ISPs to review devices across their supply chains.
This means there is a need to reconsider reactive solutions and focus on more proactive infrastructure-level measures, such as the best FWAAS and best ZTNA solution deployments.
You might also like- These are the best business laptops available to buy right now
- And you should take a look at the best office chairs we've tried
- Windows users warned of major security issue - here's why FileFix attack could be a big concern
- Reports of various Nvidia GPU scams keep surfacing, and scammers find new ways to trick shoppers
- Some buyers claim to have received old GPUs or a bag of rice instead of the card they expected to get
- Shopping and selling second-hand is riddled with tricky situations, too — my friend got scammed out of $1,900
It's definitely not a buyer's market for GPUs right now, which might explain why scams are running rampant. I keep hearing about new ways in which scammers target buyers (and sellers) of the best graphics cards, and honestly, some of them are truly baffling.
Some people are getting bags of rice and pasta instead of a high-end GPU; others get a backpack; and some get what looks like a graphics card, but the insides reveal that it'll never work.
To help you navigate the obstacle course of buying and selling GPUs right now, here's a guide to all of the main scams to watch out for – and how to avoid the fate of two of my unfortunate friends.
What kind of GPU scams are out there?I started noticing the scams in the early days following the launch of the RTX 5090. While trying to find one for sale on eBay, I noticed a lot of listings at MSRP – but checking those listings revealed that people weren't selling the GPU, but rather a printed photo of the card. Yes, a photo, for $2,000 and up.
Since then, I've heard of over a dozen innovative scams. Our sister site Tom's Hardware recently reported on an Amazon customer who ordered a Gigabyte Aorus RTX 5090 graphics card, but upon arrival, found the box to be filled with pasta, rice, and an old, dusty GPU.
I made the wonderful mistake of ordering a 5090 from Amazon Netherlands... from r/pcmasterraceMeanwhile, an unlucky Micro Center customer got several backpacks instead of the Zotac Gaming RTX 5090 Solid OC they expected to receive.
Northwest Computer Repair recently shared another scam that seems to have migrated from the RTX 4090 to the RTX 5090. The repair shop is receiving cards that have been stripped of the GPU and the memory die, leaving behind an empty shell that looks convincing enough … up until you try to use it, that is.
Another hardware repair YouTuber, this time based in China, was sent four RTX 4090 graphics cards that were reportedly in need of repair, but opening them up revealed modded RTX 3090 and RTX 3080s; three of the cards were beyond saving (via Tom's Hardware).
Buying second-hand isn't a lot easier. A friend of mine recently tried to buy an open-box RTX 5080 from a local Facebook group. He met up with the seller, paid the full price, and went home with a GPU that didn't work. He's now having to turn to the authorities for help in recovering his money.
I got scammed buying at Micro Center in Santa Clara today. from r/MicrocenterEven selling your GPU makes you vulnerable to scams. Another friend once tried to sell his RTX 3090 during the GPU shortage of 2021.
The person he met up with reportedly didn't have cash and instead showed him their banking app, confirming the transfer of £1,400 (around $1,900). It looked legitimate, so he believed it, but it was a fake app, and the money obviously never arrived. Checking Reddit shows me that this scam still exists to this day.
How to stay safe and get a legitimate GPUMany of the scams I outlined above originated from platforms you'd normally trust. Amazon and Micro Center are both trustworthy, and yet, things like this can happen, so it's important to stay vigilant.
On Amazon, I recommend buying from sellers you know and trust (or directly from Amazon). Smaller sellers, especially those with unintelligible names, are best avoided if the listing sounds too good to be true. The same rule applies to retailers: look into return policies and don't buy suspiciously cheap GPUs.
(Image credit: Shutterstock / Aleksandr Grechanyuk)Given the rising number of scams that involve the GPU box containing something other than what you ordered, make sure to film the whole unboxing process. Ideally, start filming the moment you receive the package, then show step-by-step as you open it. A photo won't suffice, as that's too easy to tamper with. If buying in store, open the box in front of an employee and inspect the contents.
Buying second-hand can be a nightmare. Even meeting up with sellers doesn't always mean that you'll get a GPU that actually works and is real. Your best bet is to meet up at a place that lets you test the GPU before picking it up, but that opens a whole new can of worms, as you'll need to enter a stranger's home. An easier way is to buy through platforms that offer buyer protection and film yourself receiving and opening the GPU.
As a seller, don't be fooled by legit-looking banking apps or promises of sending you money when they get home. Use a platform that protects both you and the buyer. It can be a hassle, but it's wild out there right now, so it's truly for the best.
You might also like