Chinese Hackers Exploit Juniper Routers with Custom Backdoors

Mandiant security researchers have uncovered a cyberespionage campaign targeting end-of-life Juniper Networks Junos OS routers. A Chinese-linked hacking group, identified as UNC3886, is behind the operation, which involves deploying custom backdoors on outdated network devices. The attackers gained privileged access using legitimate credentials and bypassed Junos OS’s veriexec subsystem, a kernel-based file integrity protection mechanism.

Once inside, they used process injection techniques to evade detection, embedding backdoors with both active and passive capabilities. A script was also found disabling logging functions on compromised routers. Analysis revealed that UNC3886 leveraged a “here document” technique to generate a base64-encoded file, which, once decoded, contained a compressed archive of malicious payloads.

Mandiant identified six modified TINYSHELL-based malware variants, each tailored for Junos OS, demonstrating the attackers’ deep understanding of the system. The group focused on targeting network authentication services like TACACS+ and terminal servers to escalate their access.

Given the complexity of analyzing proprietary network devices, tracking the full extent of the attackers’ activities posed significant challenges. Mandiant has released Indicators of Compromise (IOCs) and YARA rules to help cybersecurity teams detect infections.

To mitigate risks, organizations are urged to update their Juniper routers to the latest firmware, which includes security enhancements and mitigations. Running the Juniper Malware Removal Tool (JMRT) with a Quick Scan and Integrity Check after upgrading is also recommended. As cyberespionage threats evolve, staying ahead with timely updates and monitoring remains crucial for network security.

Source: SecurityWeek

The European Cyber Intelligence Forum is a nonprofit think tank specializing in intelligence and cybersecurity, offering consultancy services to government entities. To mitigate potential threats, it is important to implement additional cybersecurity measures with the help of a trusted partner like INFRA www.infrascan.net, or you can try yourself using check.website.