SYMBOLCOMMON_NAMEaka. SYNONYMS
elf.polaredge (Back to overview)

PolarEdge


According to Sekoia, this is a form of TLS backdoor containing pre-defined commands. Their investigation initially identified Cisco routers as a target but they also uncovered other payloads from the same family, but targeting different devices, notably Asus, QNAP and Synology. A working hypothesis suggests that devices compromised with PolarEdge could be used as Operational Relay Boxes (ORB) to facilitate offensive cyber operations.

References
2025-02-25Félix Aime, Jeremy Scion, Sekoia TDR
PolarEdge: Unveiling an uncovered ORB network
PolarEdge

There is no Yara-Signature yet.