China Hackers Spoof Certs to Deploy ShortLeash Malware

A cyber-espionage campaign with ties to China has deployed a new backdoor dubbed ShortLeash, using fraudulent digital certificates to evade detection. The campaign, identified as “LapDogs,” has targeted specific organizations by embedding the malware within seemingly legitimate software updates. Analysts say China hackers spoof certs to disguise malicious payloads and gain unauthorized access to systems.

Researchers observed that the attackers used fake code-signing certificates to build trust with the victim’s operating systems, allowing them to bypass standard security protocols. The ShortLeash backdoor enables command execution, file manipulation, and data exfiltration, posing a serious threat to compromised systems. As part of the campaign, China hackers spoof certs to maintain persistence and avoid detection from traditional antivirus tools.

The LapDogs operation appears highly coordinated and technically advanced, further highlighting the growing sophistication of state-aligned threat actors. For a more detailed breakdown of the campaign and its implications, read the full report here:

China-linked LapDogs Campaign Drops ShortLeash Backdoor with Fake Certs