Polar Edge Targets Cisco, ASUS, QNAP, Synology Routers in Expanding Botnet Campaign

Summary: Researchers detailed PolarEdge, a TLS-based ELF backdoor that targets Cisco, ASUS, QNAP, and Synology routers, first documented by Sekoia in February 2025, with evidence the activity may date to June 2023. In observed attack chains, actors exploited Cisco flaw CVE-2023-20118 to download a shell script named "q" over FTP that retrieves and runs the backdoor, which fingerprints the host to its command-and-control server and listens for commands over an mbedTLS v2.8.0 TLS server.
Bottom line: The implant does not persist across reboots, but a forked child checks every 30 seconds whether its parent process still exists and relaunches the backdoor if it is gone, so killing the process once does not remove it. Censys assessed the infrastructure as consistent with an Operational Relay Box network, and the operators' purpose for the corralled routers remains undetermined.

Read the original at The Hacker News ↗

Topics: Malware
Mentions: CVE-2023-20118
Related: CVE-2023-20118: Cisco Small Business RV Series Routers Command Injection Vulnerability Known Exploited Vulnerabilities · Mar 03, 2025
China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance Cyber Risks ·
ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026