Censys released their 2025 State of the Internet Report focusing on understanding adversary infrastructure through real investigations and data. Cobalt Strike still made up 34% of the C2 servers they tracked in May 2025, and its TeamServers stayed online for a median of only five days. The most fun chapter pivots from a single PolarEdge payload host via reused Mbed TLS test certificates to an open directory holding “RPX”, a reverse-connect proxy server that managed over 100 nodes at its peak (a direct link to PolarEdge remains unproven). PolarEdge itself was first documented by Sekoia in February 2025 as a botnet of more than 2,000 edge devices, compromised through CVE-2023-20118 in Cisco Small Business RV routers. If you enjoy 42-page PDFs about threat actor infrastructure, this one’s for you.
