XLab Unveils RPX_Client, the First Confirmed Relay Node in PolarEdge IoT ORB Network

XLab has unveiled RPX_Client as the first confirmed relay node in the PolarEdge IoT ORB network, a move that XLab asserts marks a key advancement in the threat’s operational model. The researchers describe RPX_Client as a malware component that onboards infected devices into the PolarEdge proxy pool, provides relay services, and executes remote commands, with the initial downloader file named “w” arriving from IP 111.119.223[.]196.

XLab identifies over 25,000 infected devices across 40 countries, concentrated in South Korea (41.97%), China (20.35%), Thailand (8.37%), and the United States (3.69%), with many hosts being network video recorders and routers from brands such as KT CCTV, Shenzhen TVT, and D-Link. The command-and-control infrastructure comprises 140 active RPX_Server nodes on Alibaba Cloud and Tencent Cloud, using a PolarSSL certificate and listening on port 55555, while port 55560 handles remote command execution and updates.

According to XLab, RPX_Client and RPX_Server form a classic client-server relationship within PolarEdge’s multi-hop relay design, effectively concealing attacker IPs.