A sophisticated backdoor malware targeting Internet of Things devices has surfaced, employing advanced communication techniques to maintain persistent access to compromised systems.

The PolarEdge backdoor, first detected in January 2025, represents a significant evolution in IoT-focused threats, utilizing a custom TLS server implementation and proprietary binary protocol for command and control operations.

The malware initially emerged through exploitation of CVE-2023-20118, a vulnerability affecting Cisco routers that enables remote code execution.

Attackers leveraged this flaw to deploy web shells on target routers, establishing initial footholds for subsequent payload delivery.

The attack chain involves downloading and executing a shell script named “q” via FTP, which then retrieves and launches the PolarEdge backdoor on compromised systems.

PolarEdge demonstrates remarkable versatility in its target selection, with variants identified that specifically target Asus, QNAP, and Synology network devices.

The malware’s sophisticated design suggests careful development aimed at establishing long-term presence within network infrastructure components.

Its deployment pattern indicates coordinated campaigns originating from multiple IP addresses across different countries, all utilizing identical User-Agent HTTP headers during exploitation attempts.

Sekoia analysts identified the malware’s complex architecture during detailed reverse engineering analysis, revealing a 1.6 MB ELF 64-bit executable that employs multiple operational modes.

The backdoor functions primarily as a TLS server listening for incoming commands while simultaneously maintaining communication with command and control infrastructure through daily fingerprinting operations.

Advanced TLS Implementation and Communication Protocol

The PolarEdge backdoor’s most distinctive feature lies in its custom TLS server implementation built using mbedTLS v2.8.0 library.

This approach represents a departure from conventional malware communication methods, providing encrypted channels that closely resemble legitimate network traffic.

The TLS implementation utilizes multiple certificates including leaf certificates and certificate authority chains, creating an authentic-looking encrypted communication infrastructure.

The malware implements a proprietary binary protocol operating over the TLS connection, utilizing hardcoded tokens embedded within the executable’s data sections.

This protocol requires specific magic values for request validation, including tokens stored in the malware’s configuration and others hardcoded within the binary.

Command execution occurs when incoming requests contain the ASCII character “1” in the HasCommand field, followed by a two-byte length indicator and the actual command string.

Fingerprinting operations run continuously in dedicated threads, collecting comprehensive system information including local IP addresses, MAC addresses, process identifiers, and device-specific details.

This data gets transmitted to command and control servers using HTTP GET requests with specific query string formats.

The malware constructs these requests using encrypted format strings that decode to reveal parameters such as device brand, module version, and collected system identifiers.

The backdoor supports multiple operational modes beyond its default server functionality. Connect-back mode enables the malware to function as a TLS client for file download operations, while debug mode provides configuration update capabilities for command and control server addresses.

These operational modes demonstrate the malware’s flexibility and the developers’ consideration for various deployment scenarios and maintenance requirements.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post PolarEdge With Custom TLS Server Uses Custom Binary Protocol for C2 Communication appeared first on Cyber Security News.

Cybersecurity researchers have uncovered a sophisticated phishing campaign that weaponizes the NPM ecosystem through an unprecedented attack vector.

Unlike traditional malicious package installations, this operation leverages the trusted unpkg.com CDN to deliver phishing scripts directly through browsers, targeting enterprise employees across 135+ organizations primarily in Europe’s industrial, technology, and energy sectors.

The campaign, discovered in October 2025, represents a dangerous evolution in supply chain attack methodologies.

Threat actors automated the creation of over 175 throwaway NPM packages, each serving as disposable hosting infrastructure for JavaScript code that automatically redirects victims to credential-harvesting websites.

These packages follow specific naming patterns, including the “redirect-[a-z0-9]{6}” scheme and “mad-x.x.x.x.x.x” variants, making them appear legitimate within the NPM registry.

Rather than compromising developers during traditional package installation processes, attackers distribute crafted HTML files disguised as business documents, invoices, and project files.

When victims open these seemingly innocuous files, they trigger a chain reaction that loads malicious scripts from the unpkg.com CDN, exploiting the platform’s automatic availability feature for published packages.

This approach transforms legitimate open-source hosting infrastructure into a phishing mechanism while bypassing conventional security measures.

Snyk analysts identified additional package clusters beyond those initially reported by Socket, revealing the campaign’s extensive scope.

The researchers noted that this attack demonstrates how threat actors are actively exploring new methods to weaponize the open-source ecosystem beyond conventional package-based exploits, representing a significant shift in supply chain compromise strategies.

The malware exhibits sophisticated behavioral characteristics that enhance its stealth and effectiveness.

Security check (Source – Snyk)

Upon execution, the script presents victims with a fake “Cloudflare Security Check” interface, complete with anti-analysis countermeasures designed to evade detection and inspection.

Advanced Evasion and Persistence Mechanisms

The malicious payload incorporates multiple layers of protection against security analysis and detection.

The code implements comprehensive anti-debugging measures through periodic developer tools detection, automatically blanking pages or redirecting when development consoles are accessed.

This functionality operates through size threshold monitoring and console object manipulation:-

const CHECK_INTERVAL = 600; 
const SIZE_THRESHOLD = 160; 
const REACTION = 'blank';

function sizeCheck() {
    return (dw > SIZE_THRESHOLD) || (dh > SIZE_THRESHOLD);
}

function consoleCheck() {
    Object.defineProperty(obj, 'id', {
        get: function() {
            open = true;
            return '1';
        }
    });
    console.log(obj);
    return open;
}

Additionally, the malware disables standard browser inspection capabilities by intercepting keyboard shortcuts and context menu events.

It prevents access to F12 developer tools, Ctrl+Shift+I inspector shortcuts, and Ctrl+U view source functionality through comprehensive event listener implementations.

The script also employs frame-busting techniques, attempting to redirect the top-level window after victims interact with the fake verification checkbox, ensuring maximum impact regardless of the browsing context.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Cyberattack Leverages NPM Ecosystem to Infect Developers While Installing Packages appeared first on Cyber Security News.

Cybercriminals have developed a sophisticated phishing campaign targeting Colombian users through fake judicial notifications, deploying a complex multi-stage malware delivery system that culminates in AsyncRAT infection.

The campaign demonstrates an alarming evolution in social engineering tactics, leveraging legitimate-looking governmental communications to bypass traditional security measures and successfully compromise unsuspecting victims.

The attack campaign employs carefully crafted Spanish-language emails impersonating official correspondence from “Juzgado 17 Civil Municipal del Circuito de Bogotá” (17th Municipal Civil Court of the Bogotá Circuit).

These deceptive messages inform recipients of purported lawsuits filed against them, creating urgency and authenticity through formal legal language and institutional naming conventions.

The malicious emails contain SVG (Scalable Vector Graphics) file attachments named “Fiscalia General De La Nacion Juzgado Civil 17.svg,” which translates to “Attorney General’s Office Civil Court 17.svg” in English.

Upon execution, the SVG file presents victims with a sophisticated fake webpage masquerading as the Attorney General’s Office and Citizen’s Consultation Portal.

The fraudulent interface includes fabricated elements such as judicial information systems and fake consultation registration numbers, enhancing the illusion of legitimacy.

When users attempt to download what appears to be an official document, the system initiates a complex infection chain involving multiple file stages and encoding techniques.

Seqrite analysts identified this malware campaign during their ongoing threat intelligence monitoring activities, detecting the sophisticated attack methodology that employs SVG files as initial attack vectors.

The researchers noted that SVG files have become increasingly popular among cybercriminals due to their ability to embed malicious scripts within XML code structures, often evading detection by traditional security solutions that may not thoroughly scan these file types for harmful content.

Infection Chain and Technical Implementation

The malware’s infection mechanism demonstrates advanced technical sophistication through its multi-stage delivery process.

Once the victim clicks on the malicious SVG file, embedded JavaScript code executes the OpenDocument() function, which performs several critical operations to initiate the attack sequence.

function OpenDocument() {
    // Accept base64 encoded embedded data
    // Decode it to attacker controlled "HTML" blob
    // Create a temporary URL object for that blob
    // Open that URL in new tab
}

The SVG file contains embedded base64-encoded data that, when decoded, creates an HTML blob displayed in a new browser tab.

This secondary page presents a fake progress bar interface, convincing victims that a legitimate document download is occurring while simultaneously triggering the download of a malicious HTA file named “DOCUMENTO_OFICIAL_JUZGADO.HTA.”

The HTA file serves as the next stage in the infection chain, containing heavily obfuscated code with large blocks of base64-encoded content.

When executed, it decodes and drops a Visual Basic script file called “actualiza.vbs” onto the victim’s system.

This VBS file, after removing extensive junk code designed to evade analysis, executes a PowerShell script contained within an obfuscated variable named “GftsOTSaty.”

The PowerShell component (“veooZ.ps1”) connects to a dpaste domain URL to download an encoded text file called “Ysemg.txt.”

This file undergoes multiple decoding processes, replacing specific character patterns before base64 decoding to produce “classlibrary3.dll,” a .NET assembly that functions as a module loader.

The loader incorporates anti-virtual machine techniques, checking for VirtualBox and VMware-related processes to avoid detection in analysis environments.

The final payload, AsyncRAT, gets injected into the legitimate MSBuild.exe process through sophisticated in-memory injection techniques.

This approach allows the malware to operate within a trusted Windows process, effectively evading detection while maintaining persistence on the infected system.

The AsyncRAT payload provides comprehensive remote access capabilities, including keystroke logging, system information gathering, webcam surveillance, and command-and-control communications through encrypted TLS connections using MessagePack serialization.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Leverage Judicial Notifications to Deploy Info-Stealer Malware appeared first on Cyber Security News.