PolarEdge With Custom TLS Server Uses Custom Binary Protocol for C2 Communication
A newly identified backdoor malware, named PolarEdge, has been detected targeting Internet of Things (IoT) devices using advanced communication techniques to ensure continuous access to compromised systems.
A newly identified backdoor malware, named PolarEdge, has been detected targeting Internet of Things (IoT) devices using advanced communication techniques to ensure continuous access to compromised systems.
First identified in January 2025, PolarEdge exhibits significant advancements in IoT threats. It employs a custom TLS server and a proprietary binary protocol for command and control operations.
The malware initially appeared by exploiting CVE-2023-20118, a vulnerability in Cisco routers allowing remote code execution. Attackers utilized this flaw to deploy web shells on targeted routers, establishing initial access points for subsequent payload deployment.
The attack involves downloading and executing a shell script named "q" via FTP, which retrieves and launches the PolarEdge backdoor on compromised systems.
PolarEdge demonstrates adaptability in targeting specific devices, with variations identified for Asus, QNAP , and Synology network devices.
First identified in January 2025, PolarEdge exhibits significant advancements in IoT threats.
The malware's design indicates deliberate development aimed at maintaining a long-term presence within network infrastructure components. Deployment patterns suggest coordinated campaigns from multiple IP addresses worldwide, using identical User-Agent HTTP headers during exploitation attempts.
Advanced TLS Implementation and Communication Protocol
The PolarEdge backdoor features a custom TLS server implementation utilizing the mbedTLS v2.8.0 library. This approach deviates from typical malware communication methods by providing encrypted channels resembling legitimate network traffic.
The TLS implementation employs multiple certificates, including leaf certificates and certificate authority chains, creating a legitimate-looking encrypted communication infrastructure.
The malware implements a proprietary binary protocol over the TLS connection, using hardcoded tokens within the executable's data sections. This protocol requires specific magic values for request validation, including tokens stored in the malware's configuration and others hardcoded within the binary.
Command execution occurs when requests contain the ASCII character "1" in the HasCommand field, followed by a two-byte length indicator and the command string. Fingerprinting operations run continuously in dedicated threads, collecting system information such as local IP addresses, MAC addresses, process identifiers, and device-specific details.
This information is transmitted to command and control servers via HTTP GET requests with specific query string formats. The malware constructs these requests using encrypted format strings that decode to reveal parameters like device brand, module version, and collected system identifiers.
PolarEdge supports multiple operational modes beyond its default server functionality. Connect-back mode enables the malware to act as a TLS client for file downloads, while debug mode allows configuration updates for command and control server addresses. These modes demonstrate the malware's flexibility and the developers' considerations for various deployment scenarios and maintenance needs.
Based on reporting by Cyber Security News.