Chinese Hackers Turn Unpatched Routers into ORB Spy Network

Likely Chinese nation-state hackers are converting Internet of Things devices including Ruckus Wireless home routers into an operational relay box network – a run of infections creating more digital infrastructure almost certainly used for cyberespionage.

See Also: 5 Ways Exabeam Helps Eliminate Compromised Credential Blindspots

Researchers from SecurityScorecard dub the ORB “LapDogs,” a play on hackers’ use of a fake, self-signed TLS certificate supposedly originating from the Los Angeles Police Department. Hackers behind the ORB have been building it since September 2023.

Intelligence agencies the world over use ORBs to hide nefarious activity by bouncing internet traffic through a swirl of compromised devices. Because infected devices continue to route legitimate traffic, the underlying malicious data transmission is difficult to detect. Chinese cyberespionage groups in particular have taken up ORB building for their ability to anonymize activity, reconfigure nodes into staging or command and control servers and relaying stolen data back to the mainland (see: Chinese Cyberespionage Groups Tied to ORB Network Attacks).

Forensic evidence such as developer notes written in Mandarin in a custom backdoor SecurityScorecard named “ShortLeash,” plus tools, techniques and procedures “strongly supports” attribution to a Chinese actor.

Attackers focus on Linux-based routers and IoT devices in the United States, Japan, South Korea, Taiwan and Hong Kong. Slightly more than half of roughly 1,100 known infected devices – as revealed by the presence of a fake LAPD web certificate – are access point devices made by California-based Ruckus Wireless. Attackers have also targeted wireless router made by Japan-based Buffalo Technology. A large proportion of infected devices are vulnerable to flaws in a small, open source HTTP server embedded into devices made by “Acme Laboratories,” otherwise known as programmer Jef Poskanzer. The flaws, CVE-2015-1548 and CVE-2017-17663, are both buffer memory overrun bugs. The devices also typically run old and unpatched secure shell services.

The ShortLeash backdoor executes through a startup Bash script demanding root privileges. It checks for Ubuntu or CentOS environments and drops a malicious .service file in the relevant system directory for persistence. It creates encrypted backups, runs as a background service and survives reboots. If the operating system is unsupported, the script prints a Mandarin-language error, one of several indicators suggesting a Chinese origin.

After activation, ShortLeash spins up a web server mimicking Nginx and generates a TLS certificate spoofing LAPD metadata.

The LapDogs network has quietly grown, infecting no more than 60 devices per campaign wave. The port numbers for the malicious services are centrally assigned, further suggesting operator-level coordination. About one-third of the intrusion sets show shared ISP or city-level patterns, reinforcing the theory of localized tasking.

SecurityScorecard says other threat researchers have spotted ShortLeash activity. Cisco Talos identified in March activity it tracks as UAT-5918 targeting unpatched servers. Talos found that the activity has similarities with known Chinese cyberespionage groups commonly tracked as Volt Typhoon and Flax Typhoon. A commonly held theory of Chinese hacking used to explain common tooling and TTPs visible across multiple activity centers posits that a central organization disseminates exploits to multiple cyberespionage hacking groups.