PolarEdge: Unveiling an uncovered ORB network

This report documents active exploitation of CVE-2023-20118 to deploy a TLS backdoor family dubbed PolarEdge that compromises edge devices (Cisco, Asus, QNAP, Synology). Sekoia observed webshell deployments and a MIPS64 ELF backdoor (cipher_log) forming a botnet of ~2,017 infected devices that report to attacker-controlled domains/IPs; the report provides payload analysis, delivery and reporting infrastructure details, and IoCs for detection and mitigation.