Wide Geographic Reach and Diverse Targets
SecurityScorecard reports that LapDogs features a high concentration of hacked devices across the U.S. and Southeast Asia , with additional victims identified in Japan, South Korea, Hong Kong, and Taiwan. Affected entities span various sectors including IT, networking, real estate, and media. Among the exploited hardware and services are products from Ruckus Wireless, ASUS, Buffalo, Cisco-Linksys, Cross DVR, D-Link, Microsoft, Panasonic, and Synology.

ShortLeash Backdoor: Custom and Covert
Central to LapDogs is a bespoke backdoor known as ShortLeash. Upon infection, the malware deploys a bogus Nginx web server and self-signed TLS certificate bearing the issuer name “LAPD”—an intentional mimicry of the Los Angeles Police Department, lending the campaign its alias.

ShortLeash primarily targets Linux-based SOHO devices, though evidence suggests Windows variants exist. The malware integrates into the system via a shell script, exploiting older but still vulnerable N-day flaws such as CVE-2015-1548 and CVE-2017-17663.

Timeline and Infection Patterns
SecurityScorecard identified the earliest LapDogs activity on September 6, 2023, in Taiwan, with the second wave emerging on January 19, 2024. Campaigns typically infect batches of up to 60 devices, with at least 162 distinct intrusion clusters recorded to date. Analysts believe this staggered approach helps maintain stealth and operational flexibility.

Comparison With PolarEdge but Distinct Methods
LapDogs shows parallels with another ORB network known as PolarEdge, disclosed by Sekoia earlier in February 2025. Both networks exploit router and IoT device vulnerabilities to construct sprawling infrastructure. However, STRIKE emphasizes that LapDogs is a separate entity, notable for differences in infection strategies, persistence mechanisms, and its inclusion of virtual private servers (VPS) and Windows systems.

While PolarEdge installs web shells by overwriting CGI scripts, ShortLeash embeds itself as a systemd .service file, ensuring root-level persistence after reboots.

Link to Known Chinese Threat Actors
There’s medium confidence attribution tying the UAT‑5918 group—a known China-linked actor—to use of LapDogs in operations against Taiwan. It remains unclear if UAT‑5918 is the original creator or simply a client of the infrastructure.

Security researchers warn that ORB architectures are increasingly favored by Chinese nation-state actors. Google, Mandiant, Sygnia, and SentinelOne have individually documented similar networks, noting they’re employed throughout all phases of intrusion—from reconnaissance, anonymized browsing, netflow collection, scanning, staging, command and control (C2), to staged data exfiltration.

As SecurityScorecard analysts explain, “While both ORBs and botnets commonly consist of a large set of compromised legiti­mate internet‑facing devices or virtual services, ORB networks are more like Swiss Army knives… relaying exfiltrated data up the stream”.

Why LapDogs Matters: What Organizations Should Know

1. Persistent, multi‑layered access
   ShortLeash’s integration as a root‑level service ensures longevity within infected systems, allowing adversaries to maintain control long after initial exploitation.
2. Broad, unspecific targeting
   The campaign’s low‑volume, batch‑based infections across diverse sectors and regions indicate intent for long‑term infrastructure, not quick data grabs.
3. Weaponization of dated vulnerabilities
   Despite the age of exploited flaws, their continued presence on internet‑facing devices underscores persistent patch management gaps.
4. Global interdependence
   Cross‑regional nature of attacks—spanning Asia to North America—showcases the interconnected risk landscape and the need for unified defense strategies.

Defensive Strategies for Organizations and ISPs

• Audit exposed devices: Scan for N-day vulnerabilities (including CVE-2015‑1548, CVE-2017‑17663) in SOHO and mid-tier network hardware.
• Harden configurations: Employ strong firmware management, disable unused services, isolate IoT appliances from core networks.
• Monitor for anomalies: Watch for unauthorized Nginx instances, unusual TLS certificates (look for “LAPD” issuer), and unfamiliar .service files.
• Pursue threat intelligence collaboration: Share findings and IOCs with platforms like Mandiant, Sekoia, and SecurityScorecard.

Bottom Line
LapDogs exemplifies how threat actors are evolving beyond simple botnets, leveraging legitimate hardware to build stealthy, resilient cyber-espionage infrastructures. With an estimated 1,000+ infected devices and counting, proactive measures and advanced threat detection are essential to contain these ORB-based threats.

The post New China-Based Cyber Espionage Threat Exploits Over 1,000 Routers and IoT Devices appeared first on CyberHood Sentinel.

The targeted endpoint, /developmentserver/metadatauploader, belongs to the Visual Composer component of SAP NetWeaver. The vulnerability enables remote code execution (RCE) by allowing threat actors to upload web shells without authentication.

Exploitation Targets Critical Infrastructure Worldwide

Cybersecurity researchers from EclecticIQ have uncovered widespread exploitation of the flaw by Chinese threat groups across multiple industries. At least 581 SAP NetWeaver systems have been compromised, with over 800 additional systems identified as potential future targets.

Sectors Impacted:

• UK-based natural gas and waste management firms
• Medical equipment manufacturers
• Oil and gas exploration companies in the U.S.
• Government ministries in Saudi Arabia

The discovery was made through attacker-exposed infrastructure that included detailed logs of compromised environments and targeted domains.

Threat Actors and Their Toolkits

EclecticIQ attributed the campaign to multiple China-linked APT groups including:

• UNC5221: Deployed custom malware like KrustyLoader to deliver payloads such as Sliver.
• UNC5174: Installed SNOWLIGHT loaders to fetch backdoors like GOREVERSE and VShell.
• CL-STA-0048: Attempted to establish reverse shells from infected SAP environments.
• Chaya_004: Delivered SuperShell, a Go-based reverse shell tool, to compromised systems.

These actors employed advanced tactics including custom malware, remote access trojans (RATs), and fileless persistence mechanisms.

SAP Releases Security Patch

In response to active exploitation, SAP issued Security Note 3604119 on May 13, 2025, patching CVE-2025-31324. The update also addresses a related deserialization issue tracked as CVE-2025-42999.

SAP Urges Immediate Action:

• Apply the latest patches from SAP immediately.
• Scan for compromise indicators using open-source tools from Mandiant and Onapsis.
• Monitor for suspicious activity, especially unauthorized file uploads and outbound connections to suspicious IP addresses.

Urgency for Enterprise Defenders

Given the critical severity of the flaw and ongoing exploitation, CVE-2025-31324 poses an immediate threat to global enterprise infrastructure. Unpatched SAP systems represent a high-value target for state-sponsored cyber actors seeking to disrupt essential services and steal sensitive data.

Security professionals are urged to prioritize SAP security assessments, update threat detection rules, and strengthen monitoring of external access to development endpoints.

Conclusion

The exploitation of SAP CVE-2025-31324 by China-linked APTs highlights the urgent need for robust patch management and proactive threat detection in enterprise environments. With attackers actively targeting critical infrastructure, immediate remediation and enhanced visibility are key to mitigating risk.

The post Critical SAP Vulnerability CVE-2025-31324 Exploited in Ongoing Cyberattacks appeared first on CyberHood Sentinel.

APT41, known for its dual focus on espionage and financially motivated cybercrime, has a history of targeting various industries across the globe. Their attacks typically involve exploiting vulnerabilities in widely-used software to establish a foothold, which is then used for further network exploration. The group’s ability to blend criminal and state-sponsored activities poses a significant challenge for cybersecurity professionals.

In this latest incident, the attackers’ tactics evolved in response to the organization’s security measures. When detection mechanisms were introduced, APT41 swiftly altered its methods to maintain its covert presence. The attackers displayed a high level of operational security, minimizing the use of well-known malware signatures and employing custom tools to avoid triggering alarms. This persistence and adaptability highlight the group’s strategic approach, leveraging their advanced skill set to achieve their objectives.

The incident began with initial exploitation using spear-phishing emails containing malicious links. Once a foothold was established, the attackers used sophisticated techniques, such as “living off the land” tactics, where they employed existing system tools to avoid detection. Additionally, they leveraged custom scripts and tailored malware to extract sensitive data, focusing on credentials and network configurations that could be used for further attacks.

Throughout the operation, the attackers employed multiple techniques to maintain persistence within the network, including modifying registry keys, installing backdoors, and using legitimate administrative tools like PowerShell. These methods allowed them to remain undetected for an extended period, evading standard detection mechanisms and making incident response challenging.

APT41’s focus on the gambling sector is not new; the group has targeted similar industries in the past for both financial and strategic gains. Their approach in this attack indicates a deep understanding of the targeted sector’s infrastructure and security practices, allowing them to adjust their strategies in real-time. This adaptability is a hallmark of advanced persistent threats (APTs), which often involve long-term, targeted campaigns aimed at high-value assets.

The security implications of this incident extend beyond the gambling industry, as it underscores the evolving nature of nation-state threats and the increasing use of cyber tactics for economic gain. Organizations across all sectors must recognize the potential for state-sponsored groups to target them, not just for espionage but for financial exploitation as well. This broadens the scope of potential targets and necessitates a more proactive and comprehensive approach to cybersecurity.

For organizations aiming to defend against such advanced threats, a multi-layered defense strategy is essential. This includes implementing robust endpoint detection and response (EDR) solutions, regularly updating and patching software, and conducting continuous monitoring for signs of unusual activity. Security awareness training for employees, particularly regarding phishing tactics, can also help reduce the risk of initial compromise.

The attack on the gambling industry by APT41 serves as a reminder of the complexities involved in defending against state-sponsored actors. Their ability to adapt, innovate, and remain undetected for extended periods makes them particularly dangerous. Cybersecurity teams must stay vigilant, employing advanced threat detection technologies and methodologies to identify potential intrusions early and respond effectively to mitigate damage.

APT41’s activities underscore the blurred lines between cyber espionage and financially motivated crime. While the group’s actions are aligned with national interests, their profit-driven approach suggests a dual agenda. This hybrid model of cybercrime, where state actors pursue financial objectives alongside traditional intelligence-gathering, represents a growing trend in the world of cyber threats.

The incident also emphasizes the importance of sharing threat intelligence across industries and with government agencies. Collaboration can help organizations better understand emerging threats and improve their defenses against sophisticated adversaries like APT41. Threat intelligence sharing can reveal patterns, expose new tactics, techniques, and procedures (TTPs) used by attackers, and enhance the overall security posture of potential targets.

As cyber threats continue to evolve, the need for robust security measures becomes increasingly critical. Organizations should not only focus on prevention but also invest in detection and response capabilities that can identify breaches early in their lifecycle. This proactive approach is essential for minimizing the impact of sophisticated, persistent adversaries.

APT41’s latest campaign against the gambling sector serves as a case study in the challenges of modern cybersecurity. It illustrates the lengths to which state-sponsored groups will go to achieve their objectives and the importance of remaining vigilant in the face of evolving threats. The combination of financial motivation and state-sponsored support creates a formidable adversary capable of executing complex, long-term operations with significant consequences for their targets.

The post Chinese APT41 Hackers Target Gambling Industry in Sophisticated Cyberattack appeared first on CyberHood Sentinel.

1. Introduction

The digital transformation of businesses has led to an increased reliance on cloud services for data storage and management. Snowflake, known for its innovative data warehousing solutions, has been at the forefront of this shift. However, even the most advanced systems are not immune to cyber threats. Recently, Snowflake disclosed a security breach that compromised the data of 165 customers. This breach is part of a broader extortion campaign, highlighting the persistent and evolving nature of cyber threats.

2. The Breach: What Happened?

The breach was first detected in early June 2024, when unusual activity was noticed in Snowflake’s systems. A subsequent investigation revealed that unauthorized access had been gained to sensitive customer data. The attackers exploited a vulnerability in the system, allowing them to access databases containing personal information, business data, and other confidential information.

Snowflake quickly responded by isolating the affected systems and launching a comprehensive investigation. The company also notified the affected customers and began working with cybersecurity experts and law enforcement agencies to mitigate the impact of the breach. Despite these efforts, the attackers were able to exfiltrate significant amounts of data, which they then used to initiate an extortion campaign.

3. The Extortion Campaign

The attackers behind the breach have been identified as a sophisticated cybercrime group known for their extortion tactics. After obtaining the data, they contacted the affected customers, demanding ransom payments in exchange for not leaking the stolen information. The ransom demands varied, with some customers being asked to pay substantial sums to avoid having their sensitive data exposed.

This extortion campaign follows a pattern seen in other high-profile cyberattacks, where attackers leverage stolen data to pressure victims into paying ransoms. The affected customers now face a difficult choice: pay the ransom and hope that the attackers honor their word, or refuse and risk having their data publicly exposed.

4. Implications for Snowflake and Its Customers

The breach has significant implications for both Snowflake and its customers. For Snowflake, the incident has damaged its reputation as a secure cloud data warehousing provider. The company’s response to the breach will be closely scrutinized by customers and industry experts, and its ability to restore trust will be critical to its future success.

For the affected customers, the breach poses serious risks. The exposure of sensitive data can lead to financial losses, reputational damage, and legal consequences. Businesses rely on the confidentiality and integrity of their data, and a breach of this magnitude undermines their trust in cloud service providers. In the wake of the breach, customers may seek alternative providers or demand stricter security measures from Snowflake.

5. The Broader Context: Cybersecurity in the Digital Age

The Snowflake breach is a stark reminder of the growing threat landscape in the digital age. Cybercriminals are becoming increasingly sophisticated, using advanced techniques to exploit vulnerabilities in even the most secure systems. This breach underscores the need for robust cybersecurity measures and constant vigilance.

Businesses must adopt a multi-layered approach to cybersecurity, incorporating advanced threat detection, regular security audits, and comprehensive incident response plans. The breach also highlights the importance of collaboration between companies, cybersecurity experts, and law enforcement agencies to combat cyber threats effectively.

Furthermore, the breach raises questions about the role of regulation in ensuring data security. Governments and regulatory bodies must establish clear guidelines and standards for data protection, holding companies accountable for breaches and ensuring that they implement adequate security measures.

6. Steps to Mitigate Future Breaches

In light of the Snowflake breach, companies can take several steps to mitigate the risk of future breaches:

1. Regular Security Audits: Conduct frequent security assessments to identify and address vulnerabilities.
2. Advanced Threat Detection: Implement advanced threat detection systems to monitor for suspicious activity.
3. Employee Training: Educate employees on cybersecurity best practices and the importance of data security.
4. Incident Response Plans: Develop and regularly update incident response plans to ensure quick and effective action in the event of a breach.
5. Collaboration: Work with cybersecurity experts and law enforcement agencies to stay informed about emerging threats and share information about potential risks.

7. Conclusion

The Snowflake data breach serves as a critical reminder of the importance of robust cybersecurity measures in protecting sensitive information. As cyber threats continue to evolve, businesses must remain vigilant and proactive in safeguarding their data. By adopting comprehensive security strategies and fostering collaboration, companies can mitigate the risks posed by cyberattacks and ensure the integrity and confidentiality of their data.

The post Major Data Breach at Snowflake: 165 Customers Targeted in Ongoing Extortion Campaign appeared first on CyberHood Sentinel.

Overview of the Attack

Snowflake, in collaboration with CrowdStrike and Mandiant, disclosed that the targeted attacks do not stem from a vulnerability or breach within Snowflake’s platform. Instead, threat actors have leveraged credentials obtained through information-stealing malware to access customer accounts. These credentials are primarily associated with systems that rely on single-factor authentication, making them easier targets for cybercriminals.

Key Findings and Indicators of Compromise

Mandiant’s CTO, Charles Carmakal, emphasized that attackers are using stolen credentials to log into databases configured with single-factor authentication. Some indicators of compromise include connections from clients identifying as “rapeflake” and “DBeaver_DBeaverUltimate.” These malicious activities have prompted advisories from both the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Cyber Security Centre (ACSC), recommending organizations to enable multi-factor authentication (MFA) and restrict network traffic to trusted locations.

Response and Recommendations

Snowflake and security experts stress the importance of implementing robust MFA to mitigate the risk of credential theft. Additionally, organizations are urged to monitor for unusual activity and follow guidelines to prevent unauthorized access. The incident serves as a reminder of the evolving nature of cyber threats and the necessity for continuous vigilance and proactive security measures.

Understanding Credential Theft and Its Implications

Credential theft, particularly through information-stealing malware, has become a significant threat in the cybersecurity landscape. Such malware can harvest login credentials from infected systems, which are then sold or used by cybercriminals to gain unauthorized access to various services.

How Credential Theft Occurs

1. Infection: Malware is delivered through phishing emails, malicious websites, or software vulnerabilities.
2. Data Harvesting: Once installed, the malware extracts credentials stored in browsers, password managers, or other applications.
3. Exfiltration: The stolen data is sent to the attackers, who can use it for direct attacks or sell it on the dark web.

Impact on Organizations

The consequences of credential theft can be severe, including:

• Data Breaches: Unauthorized access to sensitive information can lead to significant data breaches.
• Financial Losses: Cybercriminals can perform fraudulent transactions or demand ransom.
• Reputational Damage: Organizations may suffer long-term reputational harm, impacting customer trust and business operations.

Strengthening Security Posture

Given the increasing sophistication of cyber threats, organizations must adopt a multi-layered security approach. Here are some key strategies to enhance security:

Implementing Multi-Factor Authentication (MFA)

MFA adds an extra layer of security by requiring users to provide two or more verification factors. This could include:

• Something You Know: Passwords or PINs.
• Something You Have: Smart cards or mobile devices.
• Something You Are: Biometric verification like fingerprints or facial recognition.

Regular Monitoring and Auditing

Continuous monitoring of network activity and regular security audits can help detect and respond to suspicious behavior promptly. This includes:

• Log Analysis: Reviewing access logs for anomalies.
• Intrusion Detection Systems (IDS): Deploying IDS to identify potential intrusions.
• Regular Security Audits: Conducting periodic audits to ensure compliance with security policies.

Employee Training and Awareness

Educating employees about cybersecurity best practices is crucial. Training programs should cover:

• Phishing Awareness: Recognizing and avoiding phishing attempts.
• Password Hygiene: Encouraging the use of strong, unique passwords.
• Incident Reporting: Understanding how to report suspected security incidents promptly.

Conclusion

The targeted credential theft campaign against Snowflake customers highlights the critical need for enhanced security measures in the cloud environment. By implementing multi-factor authentication, monitoring network activity, and educating employees, organizations can better protect themselves against such threats. Continuous vigilance and proactive security practices are essential to safeguarding sensitive data and maintaining trust in cloud services.

The post Snowflake’s Latest Security Advisory: Targeted Credential Theft Campaign appeared first on CyberHood Sentinel.

In a significant cyber incident, over 600,000 routers were incapacitated by a mysterious cyberattack known as “Pumpkin Eclipse” in late October 2023. This attack targeted a single internet service provider (ISP) in the United States, causing widespread disruption and necessitating extensive hardware replacements. The attack’s scale and the specific targeting of certain router models have raised concerns within the cybersecurity community.

Details of the Attack

Timeline and Impact

The attack occurred between October 25 and 27, 2023, affecting a vast number of users who experienced sudden connectivity loss. The routers were rendered inoperable, leaving customers without internet access and forcing the ISP to undertake a massive replacement operation. The disruption underscored the vulnerability of critical infrastructure to cyber threats.

Technical Analysis

Black Lotus Labs, the threat intelligence division of Lumen Technologies, conducted an analysis and identified the Chalubo remote access trojan (RAT) as the primary malware used in the attack. Chalubo, known for its capacity to execute DDoS (Distributed Denial of Service) attacks, was used to compromise the routers, exploiting weaknesses in the devices.

Targeted Devices

The attack specifically targeted the following router models:

• ActionTec T3200
• ActionTec T3260
• Sagemcom

These models were likely chosen due to known vulnerabilities or default credentials that could be easily exploited by the attackers. The method of attack suggests that weak passwords or exposed management interfaces were significant factors in the routers’ compromise.

Motives and Attribution

Potential Motives

While the exact motives behind the attack remain unclear, several potential reasons have been speculated:

• Disruption of Service: The primary impact was a significant disruption of internet services for hundreds of thousands of users.
• Data Exfiltration: There might have been attempts to harvest sensitive information from the compromised routers.
• Testing Capabilities: The attackers might have been testing the capabilities and reach of their malware.

Attribution Challenges

Attributing the attack to a specific entity has proven difficult. The complexity and scale of the operation suggest a well-organized group, possibly state-sponsored or a highly capable criminal organization. The use of a known trojan like Chalubo, however, does not necessarily point to a specific actor, as such tools are widely available on the dark web.

Response and Mitigation

Immediate Response

The affected ISP swiftly initiated a hardware replacement program to restore connectivity to its customers. This involved not only replacing the compromised routers but also implementing more stringent security measures to prevent future incidents.

Long-term Mitigation Strategies

In response to the attack, several long-term mitigation strategies have been recommended:

• Regular Firmware Updates: Ensuring that routers and other network devices receive regular firmware updates to patch known vulnerabilities.
• Strong Password Policies: Encouraging the use of strong, unique passwords for device management interfaces.
• Network Segmentation: Implementing network segmentation to limit the spread of malware in case of a breach.
• Increased Monitoring: Enhancing network monitoring capabilities to detect unusual traffic patterns that might indicate an ongoing attack.

Broader Implications

For ISPs and Customers

The attack on such a large number of routers highlights the importance of robust security practices for ISPs and their customers. ISPs need to prioritize security in their service offerings, while customers should be aware of the security features of their network devices.

For Cybersecurity Professionals

The incident serves as a reminder of the evolving threat landscape and the need for continuous vigilance. Cybersecurity professionals must stay updated on the latest threats and techniques used by attackers and ensure that their defenses are capable of withstanding sophisticated attacks.

Conclusion

The “Pumpkin Eclipse” cyberattack on over 600,000 routers in the U.S. marks one of the most significant cyber incidents in recent times. The use of the Chalubo RAT, the targeted router models, and the large-scale impact underline the urgent need for enhanced cybersecurity measures. As investigations continue, the cybersecurity community must work together to uncover the perpetrators and develop strategies to prevent similar attacks in the future

The post Massive Cyberattack Cripples Over 600,000 Routers in the U.S. appeared first on CyberHood Sentinel.

Sobeys’ parent company Empire in a press release has revealed that while its grocery stores were still open, some services were impacted by this company-wide IT issue.

Empire revealed “The Company’s grocery stores remain open to serve customers and are not experiencing significant disruptions at this time. However, some in-store services are functioning intermittently or with a delay,”

“In addition, certain of the Company’s pharmacies are experiencing technical difficulties in fulfilling prescriptions. The Company however remains committed to the continuity of care of all its pharmacy patients.”

Employees at Sobeys reported that all computers were locked out in affected Sobeys stores, with point-of-sale (POS) and payment processing systems still online and working since they’re set up to work on a separate network.

While the company is yet to disclose any information linking this ongoing outage to a cyberattack. Canadian provincial privacy watchdogs from Quebec and Alberta have confirmed receiving “confidentiality incident” notifications from the retailer.

Photographs shared by Sobeys employees online also show in-store computers displaying a Black Basta ransom note.

The details and official confirmation from Sobeys are still awaited.

The post Black Basta ransomware targets Canada based Sobeys appeared first on CyberHood Sentinel.

The DarkTracer then mentioned that the gang is pressuring the victims by mentioning that they have already received the purchase offers from the Darkweb Leak Market and if they did not pay the ransom in time they will sold the data.

Instead of using emails to contact the victims, the gangs are asking victims to visit a TOR-based payment page. Victims are also provided with a login and password that will work on the TOR-hosted website. Allegedly, victims need to follow the instructions hosted there it get their data back. The criminals state that victims have three days to pay before they start publishing the contents of their data online

The post HARON Ransomware is on the Rise appeared first on CyberHood Sentinel.