Tag: polaredge

3 Attack Reports | 0 Vulnerabilities

Attack reports

Smoking Gun Uncovered: RPX Relay at PolarEdge's Core Exposed

A new component of PolarEdge's infrastructure, RPX_Client, has been discovered, revealing insights into the threat actor's relay operations. The investigation uncovered 140 VPS nodes acting as RPX Servers and over 25,000 infected devices serving as RPX Clients. The system uses a multi-hop design to…
evasion
iot
botnet
proxy
infrastructure
orb
command execution
polaredge
CVE-2023-20118
vps
2025-10-29
rpx_server
rpx_client
Published: October 29, 2025
Downloadable IOCs: 7

A look at PolarEdge Adjacent Infrastructure

This analysis examines the infrastructure associated with PolarEdge, an IoT botnet that exploits CVE-2023-20118. The investigation reveals connections between various certificates and services, including a WebRTC e-book certificate and suspicious PolarSSL certificates. A key discovery is the RPX se…
infrastructure
socks5
polaredge
CVE-2023-20118
2025-09-01
certificate analysis
proxy management
trojan-protocol
reverse-connect
iot botnet
rpx server
Published: September 1, 2025
Linked vulnerabilities : CVE-2023-20118
Downloadable IOCs: 4

PolarEdge: Unveiling an uncovered ORB network

An analysis of the PolarEdge backdoor and its associated botnet reveals a sophisticated cyber threat targeting various edge devices. The botnet exploits vulnerabilities in Cisco, Asus, QNAP, and Synology devices, using a TLS backdoor to establish control. Active since at least late 2023, PolarEdge …
botnet
vulnerability exploitation
asus
infrastructure analysis
edge devices
2025-02-25
qnap
cisco
polaredge
CVE-2023-20118
tls backdoor
synology
cipher_log
Published: February 25, 2025
Linked vulnerabilities : CVE-2023-20118
Downloadable IOCs: 31
Click here to see more Attack Reports