Cybersecurity researchers have shed light on the inner workings of a botnet malware called PolarEdge .

PolarEdge was first documented by Sekoia in February 2025, attributing it to a campaign targeting routers from Cisco, ASUS, QNAP, and Synology with the goal of corralling them into a network for an as-yet-undetermined purpose.

The TLS-based ELF implant, at its core, is designed to monitor incoming client connections and execute commands within them.

Then, in August 2025, attack surface management platform Censys detailed the infrastructural backbone powering the botnet, with the company noting that PolarEdge exhibits characteristics that are consistent with an Operational Relay Box (ORB) network. There is evidence to suggest that the activity involving the malware may have starte

See Full Page