Juniper Networks

In mid-2024, China-linked cyber espionage group UNC3886 targeted outdated Juniper Networks Junos OS MX routers with custom backdoors. The deployment of TINYSHELL-based backdoors, which allowed for stealthy, persistent access, showed a sophisticated understanding of system internals and posed a significant threat. This attack rendered the organization vulnerable to long-term espionage activities, primarily affecting the defense, technology, and telecommunications sectors in the US and Asia. The security incident not only undermined the integrity of Juniper Networks' devices but also put sensitive customer and employee data at risk.

Source: https://securityaffairs.com/175308/apt/china-linked-apt-unc3886-targets-eol-juniper-routers.html

TPRM report: https://www.rankiteo.com/company/juniper-networks

"id": "jun000031625",
"linkid": "juniper-networks",
"type": "Vulnerability",
"date": "6/2024",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': ['Defense',
                                     'Technology',
                                     'Telecommunications'],
                        'location': ['US', 'Asia'],
                        'name': 'Juniper Networks',
                        'type': 'Organization'}],
 'attack_vector': 'Custom Backdoors',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Customer Data',
                                              'Employee Data']},
 'date_detected': 'mid-2024',
 'description': 'China-linked cyber espionage group UNC3886 targeted outdated '
                'Juniper Networks Junos OS MX routers with custom backdoors. '
                'The deployment of TINYSHELL-based backdoors, which allowed '
                'for stealthy, persistent access, showed a sophisticated '
                'understanding of system internals and posed a significant '
                'threat. This attack rendered the organization vulnerable to '
                'long-term espionage activities, primarily affecting the '
                'defense, technology, and telecommunications sectors in the US '
                'and Asia. The security incident not only undermined the '
                "integrity of Juniper Networks' devices but also put sensitive "
                'customer and employee data at risk.',
 'impact': {'brand_reputation_impact': 'Significant',
            'data_compromised': ['Customer Data', 'Employee Data'],
            'systems_affected': ['Juniper Networks Junos OS MX routers']},
 'initial_access_broker': {'backdoors_established': ['TINYSHELL-based '
                                                     'backdoors'],
                           'entry_point': 'Outdated Juniper Networks Junos OS '
                                          'MX routers',
                           'high_value_targets': ['Defense',
                                                  'Technology',
                                                  'Telecommunications']},
 'motivation': 'Espionage',
 'post_incident_analysis': {'root_causes': 'Outdated Juniper Networks Junos OS '
                                           'MX routers'},
 'threat_actor': 'UNC3886',
 'title': 'UNC3886 Targets Juniper Networks Routers with Custom Backdoors',
 'type': 'Cyber Espionage',
 'vulnerability_exploited': 'Outdated Juniper Networks Junos OS MX routers'}