iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Mandiant found six custom malware samples on compromised Juniper MX routers running end-of-life hardware and software, and attributed the activity to UNC3886, a China-nexus espionage group. The implants could provide backdoor access and conceal activity, including by interfering with logging. Organizations should identify affected devices, move them to supported Juniper images, and run Juniper’s router checks after upgrading; an upgrade alone does not establish that a device is clean.
What Mandiant found
In a report published March 12, 2025, Mandiant said it discovered the activity in mid-2024 and attributed the custom backdoors to UNC3886. The compromised devices it describes were Juniper MX routers running end-of-life hardware and software. The finding is specific to those observed routers; it does not establish that all Juniper products or all routers are affected.
Mandiant identified six distinct samples: appid, to, irad, lmpad, jdosd, and oemd. The samples derive from TINYSHELL, but have different activation and operating capabilities. Some used names resembling legitimate Junos processes, which could make their presence less obvious during a cursory review.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The report describes both active implants, which connect outward, and passive implants, which wait for activation or incoming communication. It also identifies a script intended to disable logging mechanisms. Mandiant does not assign every behavior to each sample in its summary, so the names alone should not be treated as a complete capability map.
#1 Best Overall
- Used Book in Good Condition
How the backdoors concealed access
Mandiant says the operators had root access on the affected devices. In one described technique, they injected code into a legitimate cat process to load a position-independent lmpad payload while Veriexec remained enabled. Mandiant tracks this technique as CVE-2025-21590.
The report says lmpad could inhibit logging before hands-on activity and restore log artifacts afterward. That behavior means ordinary log review may not show a complete or trustworthy account of an operator’s actions. A lack of suspicious entries is not, by itself, evidence that a device was never compromised.
Rank #2
- Juniper Networks MX5, MX10, MX40 and MX80 3D Universal Edge Routers for the midrange deliver high
Which routers were affected?
The confirmed scope in Mandiant’s report is compromised Juniper MX routers running end-of-life hardware and software. It does not name a universal replacement model or establish a list of all affected devices or Juniper product families. Organizations should determine the hardware model, Junos version, support status, and management exposure of their own devices rather than infer exposure from the brand alone.
MITRE ATT&CK’s RedPenguin entry tracks the investigation’s first-seen period as July 2024 and last-seen period as March 2025. Those are campaign-tracking dates, not evidence that the activity ended globally in March 2025.
How to check and respond to a Juniper router
- Inventory the devices. Identify Juniper MX routers, their exact Junos versions, whether the hardware and software remain supported, and how their management interfaces and terminal or console servers are exposed.
- Review Juniper’s current guidance. Consult Juniper Security Advisories and its incident analysis for release-specific fixes and the supported Junos image appropriate to each device. Mandiant says its recommended images include mitigations and updated JMRT signatures; Juniper ties its CVE-2025-21590 guidance to supported Junos releases with the fix.
- Upgrade to a supported image. Use the device-specific instructions and a release validated for the organization’s environment. A successful upgrade is a remediation step, not proof that the router is free of an implant.
- Run the post-upgrade checks. Mandiant recommends running Juniper Malware Removal Tool (JMRT) Quick Scan and Integrity Check after the upgrade. JMRT is Juniper software for scanning Junos devices.
- Assess evidence beyond routine logs. Because the reported malware could suppress or manipulate logging, include integrity checks and other device or network evidence in the organization’s incident-response assessment. Mandiant’s report provides sample hashes, network indicators, YARA rules, and Snort and Suricata signatures; it also points to Google SecOps detection rules and a Google Threat Intelligence IOC collection. Verify the current status and applicability of indicators and rules before operational use.
- Protect management access. Secure credentials, terminal and console servers, and management interfaces with strict access controls and network segmentation. Review high-risk administrative activity. Juniper’s incident analysis says suspected infections should be reported to Juniper SIRT.
Mandiant’s guidance is: “Organizations should run the JMRT Quick Scan and Integrity Check after the upgrade.” Juniper’s incident analysis also recommends refreshing router software and hardware at regular intervals.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to consider when replacing end-of-life equipment
The incident sources do not identify a specific replacement router. A suitable refresh depends on the network’s capacity, compatibility requirements, supported lifecycle, availability of security updates, and the operational cost and risk of migration. Validate model and release choices with Juniper and against the organization’s own network requirements rather than treating a generic router recommendation as a security fix.
Quick Recap
Rank #4
- Total Number of Ports: 6
- Powerline: No
- Management Port: Yes
- Total Number of Expansion Slots: 4
- Ethernet Technology: Gigabit Ethernet
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
