Typhoon-like gang slinging TLS certificate 'signed' by the Los Angeles Police Department
ID: f8635bea-ebb8-506b-ac9c-caeeac336d5e
STIX ID: report--f8635bea-ebb8-506b-ac9c-caeeac336d5e
Feed Name: The Register (Security)
SecurityScorecard describes an ongoing, stealthy campaign dubbed "LapDogs" that has infected ~1,000 primarily SOHO devices (routers, access points, IP cameras, virtual servers) since at least September 2023 to form ORB networks used to route and obfuscate nation-state activity; intruders deploy a root‑persistent backdoor called ShortLeash (which produces a spoofed LAPD TLS certificate), exploit legacy ACME mini_httpd CVEs, and are hypothesized to be linked to Chinese Typhoon groups (Volt/Salt Typhoon), posing a significant risk to critical infrastructure and network defenders.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.