{"id":9684,"date":"2025-03-12T15:49:14","date_gmt":"2025-03-12T15:49:14","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/juniper-routers-hacked\/"},"modified":"2025-03-12T15:49:15","modified_gmt":"2025-03-12T15:49:15","slug":"juniper-routers-hacked","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/juniper-routers-hacked\/","title":{"rendered":"Juniper routers hacked"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 12, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cyber Espionage \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

A newly discovered campaign by the China-linked cyber espionage group UNC3886 has been detected, targeting obsolete MX routers from Juniper Networks to deploy custom backdoors, demonstrating their capacity to focus on internal network infrastructure.<\/p>\n

According to Google-owned Mandiant, “The backdoors had varied custom capabilities, including active and passive backdoor functions, as well as an embedded script that disables logging mechanisms on the target device,” as stated in a report<\/a> shared with The Hacker News.<\/p>\n

The threat intelligence firm views this development as an evolution of the adversary’s tactics, which have historically involved exploiting zero-day vulnerabilities in devices from Fortinet, Ivanti, and VMware to breach networks and establish remote access.<\/p>\n

First identified in September 2022, the hacking group is considered “highly skilled” and capable of targeting edge devices<\/a> and virtualization technologies<\/a> with the goal of compromising defense, technology, and telecommunications organizations in the United States and Asia.<\/p>\n

These attacks typically exploit the fact that network perimeter devices often lack security monitoring and detection solutions, allowing the hackers to operate undetected.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Mandiant noted, “The compromise of routing devices is a recent trend in the tactics of espionage-motivated adversaries, granting the capability for long-term, high-level access to crucial routing infrastructure, with potential for more disruptive actions in the future.”<\/p>\n

The latest campaign, detected in mid-2024, involves the use of implants based on TinyShell<\/a>, a C-based backdoor used by various Chinese hacking groups, including Liminal Panda<\/a> and Velvet Ant<\/a>.<\/p>\n

Mandiant identified six distinct TinyShell-based backdoors, each with unique capabilities:<\/p>\n