PolarEdgeMalware
According to Sekoia, this is a form of TLS backdoor containing pre-defined commands. Their investigation initially identified Cisco routers as a target but they also uncovered other payloads from the same family, but targeting different devices, notably Asus, QNAP and Synology.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1505.003Web Shell
“…upport of this hypothesis, interactions observed on TDR’s honeypots revealed attempts by the attacker to reuse a previously documented web shell to deploy their redirection script.”
- T1036Masquerading
“Anti-analysis measures include the PRESENT block cipher, process masquerading, /proc remounting and a watchdog fork.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
PolarEdge Backdoor on QNAP: CVE-2023-20118 Analysis“PolarEdge Backdoor on QNAP: CVE-2023-20118 Analysis”
-
ViciousTrap: Turning Edge Devices into Honeypots at Scale“…eam documented the exploitation of the CVE-2023-20118 vulnerability, which was used to deploy two distinct threats: a webshell and the PolarEdge malware.”
-
PolarEdge: Unveiling an uncovered ORB network“PolarEdge: Unveiling an uncovered ORB network”
Indicators in its reports
named in the reports above- a3e2826090f00969…c8a59c9d9082in 1 report
- 101.99.91[.]151in 1 report
- 111.90.148[.]151in 1 report
- 111.90.148[.]112in 1 report
- 101.99.91[.]239in 1 report
- c15f77d64b7bbfb3…95562b37dec4in 1 report
- 212.232.23[.]217in 1 report
- 155.254.60[.]160in 1 report
- 101.99.94[.]173in 1 report
- 103.43.19[.]61in 1 report
- 103.56.17[.]163in 1 report
- 103.43.18[.]59in 1 report
- 212.232.23[.]168in 1 report
- 212.232.23[.]143in 1 report
- 101.99.90[.]20in 1 report
- d92d2f102e1e4178…a799507e3e77in 1 report
- 20dff1120d968330…4e59474dc6bdin 1 report
- 45.77.152[.]227in 1 report
- 119.8.186[.]227in 1 report
- eda7cc5e1781c681…3b1a043cbba8in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.