ShortLeash (Windows)
- Malware type
- backdoor
- Family
- Malware family
- Profile updated
- 2026-07-07 13:15:45
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
According to STRIKE, ShortLeash is a custom backdoor used to create an ORB network. It generates unique, self-signed TLS certificates with spoofed metadata for each node. Analysis of these certificates revealed over 1000 active nodes globally and victimology supports attribution to China-Nexus APTs.
Reports & references
- Cisco Talos — Uat 5918 Targets Critical Infra In Taiwan (report)
- securityscorecard.com — Lapdogs Strike Report June 2025 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Shortleash (report)