Notifications
Clear all
Topic starter
20/08/2026 6:06 pm
TL;DR: Evidence of SOHO devices being folded into an ORB network was found in a threat hunt, with spoofed LAPD certificates and ShortLeash malware used to hide traffic and support customer logins, according to Expel. The case shows how residential and small-office edge devices can become trusted intermediaries, making device hygiene and external exposure controls part of access governance, not just perimeter defense.
NHIMG editorial — based on content published by Expel: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
Questions worth separating out
Q: What breaks when remote users authenticate through compromised home-office devices?
A: The access decision can remain technically valid while the origin of the session is completely untrusted.
Q: Why does this kind of kernel flaw matter to identity and access teams?
A: Because it compromises the host material that identity systems rely on.
Q: How do security teams detect ORB-style relay infrastructure in logs?
A: Look for repeated authentication activity from unusual geographies, spoofed certificate metadata, ephemeral-port HTTP, and short responses on paths that look like ordinary web resources.
Practitioner guidance
- Audit remote access for unmanaged-origin logins Review VPN, SaaS, and SSO logs for successful sessions originating from consumer routers, home gateways, and other unmanaged devices.
- Inspect certificate subjects and issuers in hunt queries Add certificate subject and issuer fields to threat-hunting workflows so that spoofed metadata, especially repeated self-signed strings, can be correlated across customers, devices, and session logs.
- Disable external access on SOHO administration surfaces Require remote workers and branch users to turn off exposed management services such as cloud features, web admin panels, and any externally reachable login pages on home routers.
What's in the full article
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact IOC patterns used to identify ShortLeash infections across customer logs and hunting queries
- The Appendix table of IP addresses and ASNs linked to the observed LapDogs infrastructure
- The broader hunt methodology for correlating spoofed certificate metadata with real customer activity
- The case-by-case observations behind the recommendations for remote workers and SOHO device hardening
👉 Read Expel's analysis of ORB networks, spoofed TLS certificates, and SOHO compromise →
ORB networks and spoofed TLS certificates: what teams should watch?
Explore further
20/08/2026 6:41 pm
SOHO compromise is now an identity governance issue, not just a network hygiene issue. When a legitimate authentication event originates from an unmanaged router or home gateway, the identity system inherits trust it cannot independently verify. That makes device context part of access governance, especially for SaaS, VPN, and federated login environments. Practitioners should treat the access path as a control surface, not an incidental detail.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
A question worth separating out:
Q: Who is accountable when third-party or guest device access is over-extended?
A: Accountability sits with the team that owns access lifecycle and policy enforcement, not with the guest or vendor using the device. Third-party access must have explicit expiry, review, and revocation so delegated access does not become standing privilege. That is especially important where shared endpoints are involved.
👉 Read our full editorial: ORB networks and spoofed TLS certs expose SOHO trust gaps
