Defrosting the Backdoor of PolarEdge

MITRE Techniques

• [T1210] Exploitation of Remote Services – The actor exploited CVE-2023-20118 to achieve remote code execution and deploy a web shell. Quote: ‘…attempt to exploit CVE-2023-20118, resulting in remote code execution (RCE) that deployed a web shell on the target router.’
• [T1059] Command and Scripting Interpreter – The attacker downloaded and executed a shell script named q which launched the PolarEdge backdoor. Quote: ‘…the attacker downloaded via FTP a shell script named q. Once run, q downloads, and launches the PolarEdge backdoor on the compromised system.’
• [T1573] Encrypted Channel – The backdoor implements a custom TLS server and uses TLS for C2 communication and connect-back downloads. Quote: ‘…listen for commands over a built-in TLS server implemented with mbedTLS.’
• [T1105] Ingress Tool Transfer – The connect-back mode and fingerprint thread download remote payloads written to /tmp/.qnax.sh which may be executed. Quote: ‘If the server responds with a payload, that is written to /tmp/.qnax.sh… executes it.’
• [T1027] Obfuscated Files or Information – The sample uses XOR, affine cipher, rotation ciphers, and a chained PRESENT block cipher to obfuscate configuration and sections. Quote: ‘…employs two simple rotation ciphers… implements the PRESENT block cipher… the backdoor employs a one-byte XOR…’
• [T1036] Masquerading – The backdoor randomly picks benign-sounding process names (e.g., igmpproxy, httpd) to evade detection. Quote: ‘It randomly picks one name from a predefined list: igmpproxy, wscd, /sbin/dhcpd, httpd, upnpd, iapp.’
• [T1543] Create or Modify System Process – The implant forks a child that periodically checks the parent’s /proc entry and relaunches the backdoor if absent, serving as a watchdog for re-execution. Quote: ‘it calls fork to spawn a child process that, every 30 seconds, checks whether /proc/ still exists… the child executes a shell command to relaunch the backdoor.’
• [T1112] Modify Registry (or equivalent) – The backdoor renames/removes utilities and certain CGI files on the device, likely to prevent other actors or tools from interfering. Quote: ‘mv /usr/bin/wget /usr/bin/wget_w; mv /sbin/curl /sbin/curl_c … rm -f /share/CACHEDEV1_DATA/.qpkg/CMS-WS/cgi-bin/library.cgi.bak.’