Loading story…
Mandiant and Juniper disclosed that the China-linked espionage group UNC3886 compromised end-of-life Juniper MX routers running Junos OS and deployed six TINYSHELL backdoor variants to maintain long-term access. Investigators said the campaign began by mid-2024 and marked an evolution in the actor’s tradecraft, shifting from prior targeting of virtualization and edge technologies to internal networking infrastructure. The malware set included active and passive backdoor variants, and the attackers used an embedded script to disable logging and reduce the chance of detection.
Juniper released updates for a medium-severity Junos OS kernel vulnerability affecting Junos OS products except Junos Evolved, saying exploitation requires a local attacker with high privileges to inject code into a device. Mandiant also described a novel process-injection technique used to bypass built-in protections and said it found no overlap with the broader Volt Typhoon or Salt Typhoon campaigns. Organizations were urged to upgrade to current Juniper images and run the Juniper Malware Removal Tool Quick Scan and Integrity Check on exposed devices.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Juniper later released software updates to address the underlying medium-severity Junos OS kernel vulnerability tied to the backdoor campaign. The company said the issue affects all Junos OS products except Junos Evolved and requires a local high-privilege attacker to inject code into a device.
Alongside the disclosure, Juniper published a related security advisory and recommended that customers upgrade affected devices to the latest Juniper images. Guidance also included using the Juniper Malware Removal Tool Quick Scan and Integrity Check.
On publication of Mandiant's report, the companies disclosed the months-long investigation into UNC3886's compromise of Juniper routers and attributed the activity to the China-nexus espionage actor. Mandiant said it found no overlap with Volt Typhoon or Salt Typhoon and characterized the operation as an evolution of UNC3886 tradecraft.
During the campaign, UNC3886 installed a custom malware ecosystem on compromised Junos OS devices, including six distinct TINYSHELL backdoor variants. Mandiant also identified a novel process-injection technique and scripts designed to disable logging and preserve stealthy persistence.
Mandiant said its investigation traced a China-linked UNC3886 campaign back to mid-2024, when the actor targeted end-of-life Juniper MX routers. The activity marked a shift toward compromising internal networking infrastructure for espionage purposes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
sdxcentral.com
Open sourcesupportportal.juniper.net
Open sourceaustinlarsen.me
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant and Juniper disclosed that the China-linked espionage group **UNC3886** compromised **Juniper MX routers** running end-of-life Junos OS and deployed multiple **TinyShell-based backdoors** designed for stealth and persistence. Investigators said the actor used legitimate stolen credentials to access a terminal server, dropped into the underlying FreeBSD shell, staged Base64-encoded compressed payloads, and injected malicious code into the memory of a legitimate process to evade Junos OS `veriexec` protections. The campaign also used an embedded script to disable logging, and researchers recovered as many as six backdoor variants with different command-and-control methods. Juniper tied the technique to **`CVE-2025-21590`**, an actively exploited flaw that lets a local authenticated attacker with shell access bypass `veriexec`, execute malicious code, and fully compromise affected devices. The company issued fixes across multiple Junos OS release trains and urged customers to upgrade to supported images, run the **Juniper Malware Removal Tool** quick and integrity scans, and review logs and indicators of compromise. Mandiant said it found no technical overlap between this activity and publicly reported **Volt Typhoon** or **Salt Typhoon** operations.
Jul 24, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026
Juniper disclosed **CVE-2026-21902**, a critical **remote code execution** vulnerability in *Junos OS Evolved* affecting **PTX Series** routers. The issue is an **incorrect permission assignment for a critical resource** in the **On-Box Anomaly Detection** framework; if the service is reachable over the network, an **unauthenticated attacker** can execute code as **root**, enabling full device takeover. The service is described as running as root and being enabled by default, increasing impact where exposure exists. watchTowr researchers reported the flaw and published technical analysis indicating the affected framework is intended for internal process communication and “should only be reachable” via internal interfaces, but may become accessible depending on configuration. Juniper advised customers to **restrict/filter access** (e.g., via **firewall rules or ACLs**) and indicated a patch would follow; impacted releases called out include **25.4R1-S1-EVO** and **25.4R2-EVO**, while **non-Evolved Junos OS** releases prior to `25.4R1-EVO` were reported as not impacted. Juniper stated it had **no evidence of active exploitation** at the time of disclosure.
Jun 29, 2026