Threats tagged 'polaredge'

The PolarEdge threat actor operates a sophisticated botnet infrastructure leveraging a newly discovered RPX_Client component and over 140 VPS nodes as RPX Servers. This infrastructure uses a multi-hop relay design involving more than 25,000 compromised IoT devices to conceal attack origins and enable proxy services and remote command execution. The botnet exploits CVE-2023-20118 to compromise IoT devices, facilitating anonymized and encrypted communications via SOCKS5 and Trojan protocols. Despite no known active exploits in the wild, the infrastructure poses a medium severity risk due to its potential for stealthy persistence, evasion, and large-scale disruptive attacks such as DDoS. The use of suspicious certificates and reverse-connect proxies complicates detection and mitigation efforts. The threat primarily impacts IoT ecosystems globally, with a focus on European organizations.

KEVMalware#proxy#infrastructureGermany+6