In May 2025, XLab's Cyber Threat Insight and Analysis System identified a suspicious ELF file dubbed "w" being distributed from the IP address 111.119.223.196, recognized as associated with PolarEdge but yielding no alerts on VirusTotal. This prompted a more detailed investigation that unveiled a previously undocumented component, RPX_Client. This software plays a critical role in onboarding compromised devices into a proxy pool linked to command and control (C2) nodes, facilitating remote command execution and proxy services used by attackers.