Skip to content
MalwareWiki

Malware

ShortLeash

According to STRIKE, ShortLeash is a custom backdoor used to create an ORB network.

ShortLeash is a Linux malware family.

Background

STRIKE reports that ShortLeash is a purpose-built backdoor used to stand up an ORB network. For every node it produces a unique self-signed TLS certificate carrying spoofed metadata. Examination of those certificates surfaced more than 1000 active nodes worldwide, and the victimology points to China-Nexus APTs.

Source: Malpedia (Fraunhofer FKIE).