Loading story…
Mandiant and Juniper disclosed that the China-linked espionage group UNC3886 compromised Juniper MX routers running end-of-life Junos OS and deployed multiple TinyShell-based backdoors designed for stealth and persistence. Investigators said the actor used legitimate stolen credentials to access a terminal server, dropped into the underlying FreeBSD shell, staged Base64-encoded compressed payloads, and injected malicious code into the memory of a legitimate process to evade Junos OS veriexec protections. The campaign also used an embedded script to disable logging, and researchers recovered as many as six backdoor variants with different command-and-control methods.
Juniper tied the technique to CVE-2025-21590, an actively exploited flaw that lets a local authenticated attacker with shell access bypass veriexec, execute malicious code, and fully compromise affected devices. The company issued fixes across multiple Junos OS release trains and urged customers to upgrade to supported images, run the Juniper Malware Removal Tool quick and integrity scans, and review logs and indicators of compromise. Mandiant said it found no technical overlap between this activity and publicly reported Volt Typhoon or Salt Typhoon operations.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Juniper released security updates for Junos OS to address CVE-2025-21590, a vulnerability that lets a local authenticated attacker with shell access bypass Veriexec and execute malicious code. The flaw was described as actively exploited, and Juniper recommended immediate patching and use of the Juniper Malware Removal Tool scans.
Juniper published bulletin JSA93446 covering CVE-2025-21590, the Veriexec bypass tied to the reported router compromises. The bulletin is referenced by Mandiant as the tracking and remediation notice for the issue.
In mid-2024, Mandiant reported that China-nexus espionage group UNC3886 deployed multiple TINYSHELL-based backdoors on Juniper Networks Junos OS routers and used a script to disable logging for stealth and persistence. The intrusions involved stolen legitimate credentials, access to the FreeBSD shell, and payload execution from router memory.
On its March 12, 2025 publication, Mandiant disclosed details of the Juniper router espionage campaign and attributed it to UNC3886. The report also said Mandiant had not identified technical overlaps with publicly reported Volt Typhoon or Salt Typhoon activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
supportportal.juniper.net
Open sourcecsirt.sk
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant and Juniper disclosed that the China-linked espionage group **UNC3886** compromised end-of-life Juniper MX routers running **Junos OS** and deployed **six TINYSHELL backdoor variants** to maintain long-term access. Investigators said the campaign began by mid-2024 and marked an evolution in the actor’s tradecraft, shifting from prior targeting of virtualization and edge technologies to internal networking infrastructure. The malware set included active and passive backdoor variants, and the attackers used an embedded script to disable logging and reduce the chance of detection. Juniper released updates for a **medium-severity Junos OS kernel vulnerability** affecting Junos OS products except **Junos Evolved**, saying exploitation requires a local attacker with high privileges to inject code into a device. Mandiant also described a novel process-injection technique used to bypass built-in protections and said it found no overlap with the broader **Volt Typhoon** or **Salt Typhoon** campaigns. Organizations were urged to upgrade to current Juniper images and run the **Juniper Malware Removal Tool Quick Scan** and **Integrity Check** on exposed devices.
Jun 29, 2026
Juniper Networks disclosed multiple high-severity vulnerabilities in **Junos OS** and **SRX/MX** platforms, including remotely exploitable denial-of-service flaws and local privilege-escalation issues. The most exposed bugs include **`CVE-2026-33790`**, which lets an unauthenticated attacker crash the `srxpfe` packet forwarding engine on **SRX Series** firewalls by sending a malformed **ICMPv6** packet to devices with **NAT64** enabled, and **`CVE-2026-33778`**, which allows a malformed initial **ISAKMP** packet to crash the `kmd` or `iked` daemons on **SRX** and **MX** systems providing IPsec VPN services. Juniper said repeated exploitation can sustain outages by forcing affected processes into crash loops, and that fixes were released through security bulletins including **`JSA107874`** and **`JSA107868`**. Juniper also fixed **`CVE-2026-33785`**, a missing authorization flaw in **MX Series** routers that allows any locally authenticated user to run privileged `request csds` commands and potentially compromise managed infrastructure in **JDM/CSDS** deployments, and **`CVE-2026-21916`**, a symlink-handling bug in the Junos CLI that can let a low-privileged user gain **root** when another user performs a configuration commit. Affected versions span several supported Junos release trains, with fixes issued on April 8, 2026; some older branches, including certain end-of-life releases, do not have patches. Detection guidance from Juniper and Tenable relies largely on version auditing, configuration review for exposed features such as NAT64 and IPsec, and monitoring for daemon crashes, suspicious `file link` activity, unexpected root access, and abuse of privileged management commands.
Jun 29, 2026
Juniper disclosed **CVE-2026-21902**, a critical **remote code execution** vulnerability in *Junos OS Evolved* affecting **PTX Series** routers. The issue is an **incorrect permission assignment for a critical resource** in the **On-Box Anomaly Detection** framework; if the service is reachable over the network, an **unauthenticated attacker** can execute code as **root**, enabling full device takeover. The service is described as running as root and being enabled by default, increasing impact where exposure exists. watchTowr researchers reported the flaw and published technical analysis indicating the affected framework is intended for internal process communication and “should only be reachable” via internal interfaces, but may become accessible depending on configuration. Juniper advised customers to **restrict/filter access** (e.g., via **firewall rules or ACLs**) and indicated a patch would follow; impacted releases called out include **25.4R1-S1-EVO** and **25.4R2-EVO**, while **non-Evolved Junos OS** releases prior to `25.4R1-EVO` were reported as not impacted. Juniper stated it had **no evidence of active exploitation** at the time of disclosure.
Jun 29, 2026