Chinese Hacked Exploit Juniper Networks Routers to Implant Backdoor

Cybersecurity researchers have uncovered a sophisticated cyber espionage campaign targeting critical network infrastructure, marking a significant evolution in tactics by Chinese state-sponsored hackers.

Mandiant, a leading cybersecurity firm, has discovered multiple custom backdoors deployed on Juniper Networks‘ routers, attributing the activity to a Chinese espionage group known as UNC3886.

The backdoors provided attackers with persistent access to compromised networks while actively evading detection mechanisms.

In mid-2024, Mandiant discovered threat actors had deployed custom backdoors on Juniper Networks’ Junos OS routers, which form critical components of many organizational network infrastructures.

The APT Hackers attributed these backdoors to UNC3886, a highly skilled China-nexus cyber espionage group with a history of targeting network devices and virtualization technologies, particularly within defense, technology, and telecommunication organizations across the US and Asia.

Mandiant worked with Juniper Networks to investigate the activity and determined that the affected Juniper MX routers were running end-of-life hardware and software, making them particularly vulnerable to compromise.

The discovery builds upon Mandiant’s previous reports of UNC3886’s similar malware ecosystems deployed on virtualization technologies and network edge devices in 2022 and 2023.

This latest campaign demonstrates UNC3886’s continued focus on maintaining long-term access to victim networks while showing deep understanding of the underlying technology of targeted appliances.

Sophisticated TINYSHELL-Based Backdoors with Custom Capabilities

Mandiant’s investigation identified six distinct malware samples across multiple compromised Juniper MX routers.

Each sample was a modified version of a TINYSHELL backdoor – a lightweight backdoor written in C that communicates using a custom binary protocol – but with unique capabilities specifically designed for Junos OS.

The backdoors were cleverly disguised with names mimicking legitimate Juniper system processes, including “appid,” “to,” “irad,” “lmpad,” “jdosd,” and “oemd”.

The attackers demonstrated significant technical sophistication by circumventing Juniper’s Verified Exec (veriexec) protection system, which normally prevents unauthorized code execution.

UNC3886 achieved this by injecting malicious code into the memory of legitimate processes.

The backdoors incorporated both active variants that would initiate communication with command and control servers, and passive variants that would remain dormant until receiving specific network triggers.

Perhaps most concerning was the inclusion of code specifically designed to disable logging mechanisms on the target devices, effectively erasing evidence of the attackers’ activities.

Implications and Recommendations for Network Security

The compromises highlight a concerning trend of espionage-motivated adversaries targeting routing infrastructure, which typically lacks robust security monitoring solutions such as endpoint detection and response (EDR) agents.

This activity grants attackers long-term, high-level access to crucial routing infrastructure, with potential for more disruptive actions in the future.

Mandiant has issued several recommendations for organizations to protect themselves.

First and foremost, organizations should upgrade their Juniper devices to the latest software images released by Juniper Networks, which include mitigations and updated signatures for the Juniper Malware Removal Tool (JMRT).

After upgrading, organizations should run the JMRT Quick Scan and Integrity Check.

Additional recommendations include implementing robust multi-factor authentication, granular access control for network devices, enhanced monitoring of administrative activities, prioritizing vulnerability management, implementing a device lifecycle management program, strengthening security posture through access controls and segmentation, and leveraging threat intelligence to improve security controls.

As network infrastructure continues to be targeted by sophisticated threat actors, organizations must remain vigilant and proactive in their security measures to protect these critical systems that form the backbone of digital communications.

Indicators of Compromise

Host-Based Indicators

Network Indicators

Are you from SOC/DFIR Teams?: Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.