RPX_Client: New PolarEdge Module Hijacks IoT Devices for Proxy Operations

XLab has uncovered RPX_Client, a new module linked to the PolarEdge ORB network, which hijacks IoT devices for global proxy operations. The malware, distributed from specific IP addresses, onboards infected devices into the PolarEdge proxy pool and executes remote commands. Over 25,000 devices have been compromised, primarily network video recorders and routers. The malware maintains two persistent C2 channels and uses a multi-hop proxy architecture to conceal attacker IPs. XLab attributes this activity to PolarEdge with high confidence.