PolarEdge Botnet Hits 25K IoT Devices in Major Cyber Campaign

Cybersecurity researchers at XLab have uncovered a sophisticated infrastructure-as-a-service botnet operation called PolarEdge, which has compromised over 25,000 Internet of Things devices and established 140 command-and-control servers through systematic exploitation of vulnerable edge devices.

The newly exposed RPX relay system reveals how threat actors construct operational relay box networks that effectively conceal attack sources and undermine traditional detection methods.

On May 30, 2025, XLab’s Cyber Threat Insight and Analysis System detected IP address 111.119.223.196 distributing an ELF file that initially showed zero detections on VirusTotal, prompting a comprehensive investigation.

Through targeted correlation analysis, researchers discovered RPX_Client, a previously undocumented component responsible for onboarding compromised devices into proxy pools, providing proxy services, and enabling remote command execution.

The investigation revealed that PolarEdge, first disclosed by Sekoia in February 2025, exploits vulnerable IoT and edge devices alongside purchased virtual private servers to build an Operational Relay Box network.

This architecture functions similarly to residential proxies but emphasizes long-term stealth and traffic obfuscation, making it particularly attractive to advanced persistent threat actors.

Security firm Mandiant characterized the challenge with the phrase “As the ORBs rise, the IOC goes extinct,” highlighting how these networks render traditional indicators of compromise ineffective.

Global Infection Scale

Analysis of RPX_Client datasets revealed that since July 2024, the botnet has cumulatively infected more than 25,000 IP addresses across 40 countries and regions, with infection rates showing sustained upward trends.

The compromised devices are primarily concentrated in Southeast Asia and North America, with South Korea accounting for 41.97 percent of infections, followed by China at 20.35 percent, Thailand at 8.37 percent, and Malaysia at 5.98 percent.

The primary targets include KT CCTV systems and Shenzhen TVT digital video recorders, which together represent over 90 percent of infected devices.

Additional compromised equipment includes Asus routers, DrayTek routers, Cisco RV340 VPN routers, D-Link routers, Cyberoam unified threat management devices, and Uniview webcams.

These 140 servers exhibit interesting characteristics: they are all VPS nodes, concentrated in ASNs 45102, 37963, and 132203, and hosted on Alibaba Cloud and Tencent Cloud.

Reverse engineering also revealed an API that exports proxy pool nodes into Clash configuration files, enabling use by attackers or specific campaigns.

RPX Client: 25,000+ Infected Devices

Through technical means, we obtained partial RPX_Client datasets. The data includes fields such as IP, brand, createAt, and onlineTime, enabling in-depth analysis of PolarEdge RPX across multiple dimensions: infection scale, geographic distribution, and device types.

Statistics show that since July 2024, over 25,000 IPs have been cumulatively infected, with the infection scale showing a sustained upward trend.

Infected devices are distributed across 40 countries and regions, primarily concentrated in Southeast Asia and North America.

The top 10 countries are: South Korea 41.97%, China 20.35%, Thailand 8.37%, Malaysia 5.98%, India 3.79%, Israel 3.73%, USA 3.69%, Vietnam 2.56%, Indonesia 2.12%, Russia 1.19%.

Attackers exploited CVE-2023-20118 to spread malicious scripts beginning in April 2025, establishing persistence through modified initialization scripts.

The RPX system operates through a client-server architecture where RPX_Server functions as a reverse-connection proxy gateway that does not connect directly to targets.

Instead, it schedules registered proxy nodes to connect to targets, which then establish reverse connections to dynamically allocated temporary ports on the gateway. This multi-hop design effectively conceals attack sources through transparent traffic bridging.

Server infrastructure consists of 140 VPS nodes concentrated in autonomous system numbers 45102, 37963, and 132203, hosted primarily on Alibaba Cloud and Tencent Cloud.

These servers run four core services: RPX_Server for proxy operations, Go-Admin for node management and session validation, Nginx operating in reverse proxy mode, and Go-Shadowsocks for proxy services.

Each service produces distinct network fingerprints, including fixed self-signed certificates that researchers used to identify active infrastructure.

The RPX_Client component, currently at version 0.0.13, disguises its process name as “connect_server” and maintains configuration data in encrypted files using single-byte XOR encryption.

After compromising devices, it establishes two independent network connections to control servers: one on port 55555 for node registration and traffic proxying, and another on port 55560 for remote command execution.

The malware includes built-in commands for changing control server addresses and performing self-upgrades, enabling operators to achieve fine-grained control and rapidly migrate proxy pools when infrastructure is exposed.

Attribution and Ongoing Threat Activity

XLab researchers established high-confidence attribution to PolarEdge through multiple evidence streams, including coding style homology with known PolarEdge samples, functional complementarity between RPX_Client and RPX_Server components, and database records documenting distribution activities.

IP address 82.118.22.155, which spread malicious scripts in December 2023, was definitively linked to PolarEdge infrastructure through domain name system records connecting to Sekoia-disclosed command-and-control servers.

The investigation also revealed an API that exports proxy pool nodes into Clash configuration files, enabling attackers to utilize the compromised infrastructure for specific campaigns.

Command tracking systems demonstrated that while most traffic appears non-targeted and flows to mainstream services like QQ, WeChat, Google, and Cloudflare, the infrastructure provides attackers with effective operational cover.

Server logs confirmed that distribution IP 111.119.223.196 functioned both as a download server and reverse shell command-and-control node.

Researchers acknowledge that no single security vendor maintains complete visibility into this threat ecosystem, emphasizing that thorough analysis requires broad industry collaboration.

The combined research efforts of Sekoia, Censys, and XLab have established a foundation for understanding PolarEdge’s operational relay box network, though specific connections between PolarEdge backdoor samples and the RPX system remain areas requiring further investigation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.