Loading story…
PolarEdge has compromised internet-facing devices from Cisco, ASUS, QNAP, and Synology, creating a covert botnet whose operators and ultimate purpose remain unknown. HivePro reports more than 2,000 infections worldwide and activity dating to late 2023. Sekoia first detected the botnet in January 2025 through attacks exploiting CVE-2023-20118 on Cisco routers, then identified related backdoor samples targeting other vendors. That exploitation finding does not establish that the same vulnerability affects the QNAP, ASUS, or Synology devices.
Sekoia’s analysis of a QNAP NAS implant found a TLS server that accepts arbitrary commands and a separate channel that sends daily host fingerprints to command-and-control infrastructure and can download and execute additional payloads. The custom command protocol has no additional authentication beyond extractable magic tokens. Encrypted configuration and code sections, process masquerading, concealment of process information, and a watchdog complicate detection, but do not substantiate claims that the backdoor is undetectable. The analyzed implant does not itself persist across reboots; auxiliary modes support TLS file retrieval and C2 address updates. Defenders should prioritize patching affected Cisco routers, restricting internet exposure of device-management interfaces, and investigating unexpected TLS listeners, outbound beaconing, and suspicious processes on edge devices and NAS systems.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Sekoia originally distributed its PolarEdge technical analysis as a private FLINT report. The analysis described a QNAP implant supporting arbitrary command execution over TLS, daily host fingerprinting, additional payload execution, and process-concealment mechanisms, but no built-in persistence across reboots.
Sekoia provided a PolarEdgeBackdoor YARA rule dated July 10, 2025. It detects ELF files smaller than 2 MB using the PRESENT inverse S-box alongside configuration markers or characteristic command-line strings.
Cisco-router honeypots detected simultaneous exploitation of CVE-2023-20118 from multiple IP addresses in different countries. Attackers retrieved a shell script named q over FTP, which downloaded and launched the PolarEdge backdoor.
Researchers first detected PolarEdge when honeypots observed attackers exploiting CVE-2023-20118 on Cisco routers. The exploitation achieved remote code execution and deployed a web shell.
PolarEdge reportedly began operating in late 2023, compromising internet-connected devices and installing backdoors.
Researchers identified related PolarEdge backdoor payloads targeting Asus, QNAP, and Synology devices, extending the observed targeting beyond Cisco routers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The PolarEdge botnet has been identified as a sophisticated malware campaign targeting network routers from major vendors including Cisco, ASUS, QNAP, and Synology. Security researchers from Sekoia first documented PolarEdge in early 2025, attributing its activity to a campaign that leverages known vulnerabilities in these devices, notably exploiting CVE-2023-20118 in Cisco routers. Attackers use this vulnerability to download a shell script named 'q' via FTP, which subsequently retrieves and executes the PolarEdge backdoor on compromised systems. The malware is implemented as a TLS-based ELF implant, capable of monitoring incoming client connections and executing commands within them. PolarEdge supports two primary modes of operation: a connect-back mode, where it acts as a TLS client to download files from remote servers, and a debug mode, which allows for on-the-fly configuration changes such as updating server information. The configuration data is embedded and obfuscated within the ELF binary, requiring decryption with a specific XOR key. By default, the backdoor operates as a TLS server, sending host fingerprint data to its command-and-control (C2) server and awaiting further instructions. Researchers have observed that PolarEdge does not ensure persistence across device reboots, but it employs a process monitoring technique where a child process checks every 30 seconds if its parent is still running, relaunching the backdoor if necessary. The botnet also incorporates multiple anti-analysis techniques to evade detection and hinder forensic investigation. The infrastructure supporting PolarEdge has been described as resembling an Operational Relay Box (ORB) network, with evidence suggesting the campaign may have begun as early as June 2023. In addition to its core backdoor functionality, PolarEdge has been linked to the transformation of compromised devices into SOCKS5 residential proxies, facilitated by the GhostSocks malware-as-a-service tool. The full scope and objectives of the botnet remain undetermined, but its technical sophistication and ability to compromise a range of popular router brands highlight a significant threat to both enterprise and residential networks. The campaign's use of TLS for both command-and-control and anti-analysis purposes complicates detection and mitigation efforts. Security teams are advised to patch affected devices, monitor for unusual TLS traffic, and review router configurations for signs of compromise. The ongoing analysis by multiple cybersecurity firms underscores the evolving nature of the PolarEdge threat and the need for continued vigilance against router-targeting malware campaigns.
Jun 29, 2026
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026
Researchers have identified a previously undocumented botnet dubbed **AryStinger** that has compromised more than 4,000 legacy routers worldwide and repurposed them as attacker-controlled proxies for reconnaissance, tunneling, traffic interception, DNS tampering, and remote command execution. QiAnXin XLab said the campaign primarily targets outdated **RTL819X-based** devices, including **D-Link DIR-850L** and **DIR-818LW** routers, and also includes a newer Go-based variant aimed at NAS devices. Infections are concentrated in **South Korea** and **China**, with additional activity observed in **Sweden, Malaysia, and Singapore**. The malware exploits long-known flaws including `CVE-2013-3307` and `CVE-2016-5681` on older Linksys and D-Link hardware, while the NAS-focused strain has been linked to `CVE-2025-11837`. XLab reported that AryStinger communicates with command-and-control servers over HTTP/HTTPS using **Protobuf** with **XOR** encryption, establishes persistence through **Dropbear** or **gs-netcat**, and appears designed less for DDoS or cryptomining than for building covert attack infrastructure. Researchers said attribution remains unclear and urged organizations and consumers to replace end-of-life routers, update firmware, change default administrator credentials, and disable remote management.
Jul 12, 2026