PolarEdge Botnet Hits 25K IoT Devices in Major Cyber Campaign

According to XLab’s Cyber Threat Insight and Analysis System, the PolarEdge botnet has compromised over 25,000 Internet of Things devices and established 140 command-and-control servers through systematic exploitation of vulnerable edge devices. The operation uses an infrastructure-as-a-service RPX relay system to conceal attack sources and enable remote command execution, with RPX_Client onboarding compromised devices into proxy pools.

Since July 2024, the RPX network has infected more than 25,000 IP addresses across 40 countries and regions, with the majority of infections in Southeast Asia and North America; South Korea accounts for 41.97% of infections, followed by China at 20.35%. Attackers exploited CVE-2023-20118 to spread malicious scripts from April 2025, and the RPX system runs on 140 VPS nodes hosted on Alibaba Cloud and Tencent Cloud.

The primary targets include KT CCTV systems and Shenzhen TVT digital video recorders, together representing over 90% of infected devices, and the infrastructure also includes Asus and DrayTek routers among others. Attribution to PolarEdge was established by XLab researchers, with links to Sekoia-disclosed activity and Go-Server/Go-Shadowsocks components, while IP 111.119.223[.]196 was identified as a distribution and reverse shell C2 node.