China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors

Cisco says the threat actor behind the LapDogs campaign has expanded its SOHO router malware toolkit with LongLeash, DogLeash, and JarLeash backdoors. The post China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors appeared first on SecurityWeek .

According to Cisco, the China-linked APT group behind the LapDogs campaign (tracked as UAT-7810) has expanded its SOHO router malware toolkit with new backdoors named LongLeash, DogLeash, and JarLeash, enabling persistent access to compromised network devices for espionage operations.[2][3][5][7] These backdoors focus on edge and router infrastructure, making it harder for traditional endpoint defenses to detect and remediate the intrusions.[2][5] From a RealGround perspective, while the campaign is not directly AI-focused, it heightens risk to AI systems by compromising the underlying network, which can be used to exfiltrate AI models and training data or to tamper with AI agent traffic and APIs. Organizations should integrate continuous red teaming and CISO-level AI security planning, and account for compromised network and router infrastructure as a critical part of AI supply chain and SBOM risk management.