Sekoia Exposes PolarEdge Backdoor: Custom mbedTLS C2 Compromising Cisco, QNAP, and Synology Devices

According to Sekoia Threat Detection & Response (TDR) researchers, PolarEdge is a stealthy backdoor deployed through exploitation of CVE-2023-20118, a remote code execution flaw affecting Cisco routers, with the initial botnet later seen spreading to Asus, QNAP and Synology devices. The backdoor functions as a custom TLS server, implemented with mbedTLS v2.8.0, able to receive commands and execute them on the infected host, and it periodically sends a host fingerprint to its command-and-control server.

At startup it moves and deletes certain files to block other threat actors from accessing the same vulnerabilities, and it renames or removes utilities such as /usr/bin/wget and /sbin/curl to hinder competing malware. The configuration data is stored within the final 512 bytes of the binary, obfuscated by a one-byte XOR key, and the malware communicates using a custom binary protocol over TLS with a series of fixed magic tokens.

Beyond its default server mode, it supports connect-back and debug modes for dynamic C2 updates, enabling remote command execution and persistence as described by Sekoia’s analysis.