PolarEdge Targets Cisco, ASUS, QNAP, Synology Routers in Expanding Botnet Campaign

Cybersecurity researchers have outlined a growing botnet campaign by PolarEdge, first documented by Sekoia in February 2025, targeting routers from Cisco, ASUS, QNAP, and Synology to recruit devices into a network for an as-yet-undetermined purpose.

According to Sekoia, the TLS-based ELF implant at the core monitors incoming connections and executes commands within them, with February 2025 activity showing threat actors exploiting Cisco router flaws (CVE-2023-20118) to download a shell script that retrieves and runs the PolarEdge backdoor.

The backdoor uses a TLS server implemented with mbedTLS and supports a connect-back mode to fetch files or a debug mode to alter its configuration, while its default operation behaves as a TLS server to send a host fingerprint to its C2 server. Researchers note that PolarEdge also employs anti-analysis techniques, process masquerading, and a mechanism to relaunch after the parent process disappears, and that the activity may trace back to earlier June 2023 developments. The disclosure also references Censys’s August 2025 detailing of PolarEdge’s infrastructure as an Operational Relay Box network.