Chinese Cyberespionage Group Tied to Juniper MX Router Hacks

A Chinese cyberespionage operation is targeting outdated Juniper Network routers with a custom backdoor, further evidence of an onslaught by nation-state hackers against poorly secured edge devices.

See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware

Google’s Mandiant threat intelligence group said it discovered the attack campaign in mid-2024 after finding routers running Juniper’s Junos OS infected with malware by a Beijing-aligned group it tracks as UNC3886.

In a report released Wednesday in coordination with Juniper, Mandiant detailed the campaign as well as the backdoors being installed in routers, which are based on a publicly available, open source Unix backdoor called Tiny Shell.

“The backdoors had varying custom capabilities, including active and passive backdoor functions, as well as an embedded script that disables logging mechanisms on the target device,” and demonstrated that the group involved “has in-depth knowledge of advanced system internals,” Mandiant said.

Hackers bypassed Verified Exec, aka veriexec, the file-signing and verification scheme built into Junos OS that’s meant to ensure only authorized binaries execute on its devices. Verified Exec should trigger alerts if attackers attempt to disable it. Mandiant said attackers nonetheless sidestepped it “by injecting malicious code into the memory of a legitimate process.”

Juniper and Mandiant have released two joint security alerts – JSA93446 and JSA5385 – detailing the risks and how users should address them.

Warnings over the attack campaign follow evidence that nation-states and sophisticated cybercrime hackers have honed in on edge devices as a vector for network access. Investigators probing the Chinese hackers tracked as Salt Typhoon who infiltrated U.S. telecoms to spy on top governmental and political targets said they often exploited known vulnerabilities or poorly configured defenses (see: Edge Devices Face Surge in Mass Brute-Force Password Attacks).

Analysis by cybersecurity firm With Secure of the Known Exploited Vulnerabilities Catalog from the U.S. Cybersecurity and Infrastructure Security Agency found that during this decade, hackers have developed exploits for edge devices at a growing rate, including by identifying unpatched vulnerabilities. Edge devices such as routers, firewalls and managed file transfer tools “represent a weak spot in our collective defenses,” a problem compounded by poor rates of patching, cybersecurity firm Rapid7 warned last May (see: Surge in Attacks Against Edge and Infrastructure Devices).

Mandiant said it hasn’t found any “technical overlaps” between the Juniper Junos OS campaign and publicly reported details tied to attacks attributed to either Salt Typhoon or Volt Typhoon, which regularly targets privately owned networking devices to target critical infrastructure.

Working with Juniper Networks to probe the attacks, Mandiant said it found that all of the infected Juniper MX routers “were running end-of-life hardware and software.”

To combat the attacks, Mandiant recommends administrators immediately “upgrade their Juniper devices to the latest images,” which contain updated JMRT – for Juniper Malware Removal Tool – signatures and other attack mitigations.

“Organizations should run the JMRT Quick Scan and Integrity Check after the upgrade,” Logesh N, a manager at Mandiant Consulting and co-author of its research report, told Information Security Media Group. “Mandiant recommends performing this activity on all versions as a best practice and not just as a reaction to this particular threat.”

Quick scan analyzes the device’s processes and memory for signs of malware and, if found, stops the process and deletes the malware files, while integrity check ensures that the integrity mechanism called Verified Exec, which stops unapproved binaries from running, is enabled.

Mandiant attributed the attacks to a “China-nexus espionage group” that it tracks as UNC3886, meaning it’s so far an “uncharacterized” group, as opposed to groups that are clearly nation-state teams – aka advanced persistent threat groups – or else primarily financially motivated actors.

As that suggests, the identity of whoever runs the group and their relationship to the Chinese state isn’t clear, although Beijing regularly relies on a vast network of private sector contractors to carry out its hacking (see: US Seizes Chinese Hacker Infrastructure, Unseals Indictments).

While researchers haven’t detailed any specific victims of this Juniper router-targeting campaign, “Mandiant has identified that UNC3886 has historically focused on targeting the aerospace and defense, energy and utilities, government, telecommunications and technology sectors,” predominantly in the U.S. and Asia, Austin Larsen, principal threat analyst at Google Threat Intelligence Group, told Information Security Media Group.

In addition, the group has appeared “highly adept” at exfiltration activities, including targeting both network devices and virtualization technologies using zero-day exploits, Mandiant said.