PolarEdge C2 Communication via Custom Binary Protocol with Custom TLS Server

In early 2025, security researchers identified a sophisticated botnet implant named PolarEdge that relies on a bespoke TLS server and a proprietary binary protocol to perform unauthenticated command-and-control operations. PolarEdge first emerged in January 2025, with honeypots monitoring Cisco routers capturing traffic exploiting CVE-2023-20118 and enabling remote code execution to download an FTP shell script and deploy the implant.

On 10 February, a second wave of exploit attempts against the same vulnerability was observed, this time downloading a script that installed the PolarEdge backdoor; further samples targeted Asus, QNAP, and Synology routers, indicating a broad campaign. The primary sample targets QNAP NAS devices and, when run without arguments, spawns an mbedTLS-based TLS server on port 49254, sending a daily host fingerprint to the C2 and awaiting commands over a custom binary protocol.

The backdoor encrypts configuration data with XOR and rotation ciphers, uses a PRESENT cipher in a chained mode for runtime decryption, and saves any fetched payload to a controlled path such as /tmp/.qnax[.]sh for execution.