LiveActive security incident?Get immediate response
MITRE ATT&CK® Campaign

C0056: RedPenguin

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]

EnterpriseC0056CampaignObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

RedPenguin matters because ATT&CK describes it as activity involving malware infections of Juniper MX Series routers and custom TINYSHELL backdoors. For leaders, the practical issue is not a desktop malware problem; it is potential compromise of edge/network infrastructure that can affect visibility, routing trust, credential exposure, and incident response confidence.

Executive priority

Prioritize this as an edge-infrastructure resilience and evidence-readiness issue. Executives should ask whether Juniper MX and similar network devices are inventoried, centrally logged, access-controlled, and included in incident response playbooks. Because the campaign is attributed in ATT&CK to UNC3886 and uses stealth, proxying, valid accounts, rootkits, and exfiltration-over-C2 techniques, coverage depends on router telemetry, privileged access governance, and the ability to preserve forensic evidence before cleanup activity removes it.

Technical view

ATT&CK provides no official detection text and no campaign-level platforms, but the description identifies Juniper MX routers and relationships include Network Device CLI, Unix Shell, Valid Accounts, Rootkit, Network Sniffing, Proxy/Multi-hop Proxy, Non-Application Layer Protocol, Traffic Signaling, Ingress Tool Transfer, File Deletion, and Clear Network Connection History. SOC and IR teams should validate whether network-device logs, authentication records, configuration history, file/process visibility where available, and network flow/packet evidence can support investigation of stealthy command execution, tool transfer, hidden services, credential use, and outbound C2 paths.

Likely telemetry

  • Network device authentication and authorization logs, especially administrative and privileged account use
  • Network Device CLI command history and configuration change records where retained
  • Router/system logs showing process execution, shell access, file creation, file deletion, or abnormal service behavior where available
  • NetFlow, firewall, IDS/IPS, and packet metadata for unusual outbound connections, proxy behavior, non-application-layer protocols, or traffic signaling patterns
  • Configuration backups and integrity baselines for Juniper MX routers and other edge devices

Detection direction

  • Do not assume endpoint EDR coverage applies to routers; validate device-native logging and network-based monitoring separately.
  • Tune for abnormal administrative access, unusual CLI activity, unexpected shell use, and changes to network-device configuration or connection history.
  • Correlate valid-account activity with unusual source locations, timing, device targets, and follow-on network connections.
  • Look for stealth indicators suggested by related techniques: hidden or masqueraded files, rootkit-like concealment, process injection behavior where observable, file deletion, and cleared connection history.
  • Use network telemetry to identify proxy chains, non-standard C2 channels, multi-stage communications, and exfiltration over existing C2 rather than relying only on known indicators.

Mitigation priorities

  • Inventory Juniper MX routers and other critical edge/network devices, confirm ownership, software/firmware state, and exposure paths.
  • Apply relevant vendor guidance from the cited Juniper and Mandiant reporting and maintain a patch/vulnerability management process for edge infrastructure.
  • Restrict and monitor administrative access to network devices; enforce least privilege, strong authentication where supported, and separation of administrative accounts.
  • Preserve centralized logs and configuration backups so file deletion or cleared connection history on the device does not eliminate investigative evidence.
  • Limit outbound connectivity from network infrastructure to expected destinations and protocols where operationally feasible.
Additional notes and limits

The campaign is linked by ATT&CK to UNC3886 and to REPTILE, MEDUSA, and multiple techniques spanning execution, stealth, credential access, discovery, command and control, and exfiltration. The most decision-useful takeaway is to test whether edge/network infrastructure is monitored and recoverable at the same standard as servers and endpoints.

ATT&CK does not provide official detection guidance, campaign-level platforms, or detailed procedure examples in the supplied fields. This summary uses only the supplied description, external references, and relationships; local device models, logging configuration, network architecture, and vendor advisories are required to determine actual exposure and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

RedPenguin

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

26 rows
DomainIDNameRelationship / procedure
EnterpriseT1057Process Discovery

During RedPenguin, UNC3886 used malware capable of reading the PID for the Junos OS snmpd daemon.[1]

EnterpriseT1040Network Sniffing

During RedPenguin, UNC3886 used a passive backdoor to act as a libpcap-based packet sniffer.[2]

EnterpriseT1587.001MalwareSub-technique

During RedPenguin, UNC3886 deployed custom malware based on the publicly-available TINYSHELL backdoor.[2][3]

EnterpriseT1104Multi-Stage Channels

During RedPenguin, UNC3886 used malware with separate channels to request and carry out tasks from C2.[2]

EnterpriseT1059.008Network Device CLISub-technique

During RedPenguin, UNC3886 accessed the Junos OS CLI on targeted devices.[2][1]

EnterpriseT1571Non-Standard Port

During RedPenguin, UNC3886 used a backdoor that binds to port 45678 by default.[2]

EnterpriseT1070.007Clear Network Connection History and ConfigurationsSub-technique

During RedPenguin, UNC3886 used an implant to delete logs associated with unauthorized access to targeted Junos OS devices.[1]

EnterpriseT1078Valid Accounts

During RedPenguin, UNC3886 used legitimate credentials to gain priviliged access to Juniper routers.[2][3]

EnterpriseT1059.004Unix ShellSub-technique

During RedPenguin, UNC3886 used malware capable of launching an interactive shell.[2][1]

EnterpriseT1203Exploitation for Client Execution

During RedPenguin, UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.[2][1]

EnterpriseT1573.001Symmetric CryptographySub-technique

During RedPenguin, UNC3886 malware used the RC4 cipher to encrypt outgoing C2 messages.[1]

EnterpriseT1016System Network Configuration Discovery

During RedPenguin, UNC3886 leveraged JunoOS CLI queries to obtain the interface index which contains system and network details.[2][1]

EnterpriseT1090Proxy

During RedPenguin, UNC3886 used malware capable of establishing a SOCKS proxy connection to a specified IP and port.[2][1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

During RedPenguin, UNC3886 created multiple strains of malware using names to mimic legitimate binaries such as appid, to, irad, lmpad, jdosd, and oemd.[2]

EnterpriseT1055Process Injection

During RedPenguin, UNC3886 exploited CVE-2025-21590 to enable malicious code injection into the memory of legitimate processes.[2][1]

EnterpriseT1140Deobfuscate/Decode Files or Information

During RedPenguin, UNC3886 used malware implants to deobfuscate incoming C2 messages and encoded archives.[2][1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

During RedPenguin, UNC3886 generated Base64-encoded files in the FreeBSD shell environment of targeted Juniper devices.[2][1]

EnterpriseT1205Traffic Signaling

During RedPenguin, UNC3886 leveraged malware capable of inpecting packets for a magic-string to activate backdoor functionalities.[2]

EnterpriseT1690Prevent Command History Logging

During RedPenguin, UNC3886 used malware to clear the `HISTFILE` environmental variable and to inject into Junos OS processes to inhibit logging.[2][1]

EnterpriseT1105Ingress Tool Transfer

During RedPenguin, UNC3886 used backdoor malware capable of downloading files to compromised infrastructure.[2]

EnterpriseT1090.003Multi-hop ProxySub-technique

During RedPenguin, UNC3886 used infrastructure associated with operational relay box (ORB) networks.[2]

EnterpriseT1095Non-Application Layer Protocol

During RedPenguin, UNC3886 leveraged malware that used UDP and TCP sockets for C2.[2][3][1]

EnterpriseT1554Compromise Host Software Binary

During RedPenguin, UNC3886 peformed a local memory patching attack to modify the snmpd and mgd Junos OS daemons.[1]

EnterpriseT1070.004File DeletionSub-technique

During RedPenguin, UNC3886 used malware capaple of removing scripts after execution.[2]

EnterpriseT1014Rootkit

During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.[2]

EnterpriseT1041Exfiltration Over C2 Channel

During RedPenguin, UNC3886 uploaded specified files from compromised devices to a remote server. [2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1048: UNC3886

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]

MalwareEnterprise

S1219: REPTILE

REPTILE is an open-source Linux rootkit with multiple components that provides backdoor access and functionality.[1]

Linux
MalwareEnterprise

S1220: MEDUSA

MEDUSA is an open-source rootkit that is capable of dynamic linker hijacking, command execution, and logging credentials.[1]

Linux
Relationship explorer

All related ATT&CK context

uses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1040: Network SniffingEnterpriseuses · TechniqueT1587.001: MalwareEnterpriseuses · TechniqueT1104: Multi-Stage ChannelsEnterpriseuses · MalwareS1219: REPTILEEnterpriseattributed to · GroupG1048: UNC3886Enterpriseuses · TechniqueT1059.008: Network Device CLIEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1070.007: Clear Network Connection History and ConfigurationsEnterpriseuses · TechniqueT1078: Valid AccountsEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · MalwareS1220: MEDUSAEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1205: Traffic SignalingEnterpriseuses · TechniqueT1690: Prevent Command History LoggingEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
271f2538f23c7aab...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle271f2538f23c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  2. [2]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  3. [3]
    Censys RedPenguin MAR 2025

    Censys Research Team. (2025, March 14). JunOS and RedPenguin. Retrieved June 24, 2025.

    Open source URL
  4. [4]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  5. [5]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  6. [6]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  7. [7]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  8. [8]
    mitre-attackC0056
    Open source URL
  9. [9]
    mitre-attackC0056
    Open source URL
  10. [10]
    mitre-attackC0056
    Open source URL
  11. [11]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  12. [12]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  13. [13]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  14. [14]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  15. [15]
    Censys RedPenguin MAR 2025

    Censys Research Team. (2025, March 14). JunOS and RedPenguin. Retrieved June 24, 2025.

    Open source URL
  16. [16]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  17. [17]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  18. [18]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  19. [19]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  20. [20]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  21. [21]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  22. [22]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  23. [23]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  24. [24]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  25. [25]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  26. [26]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  27. [27]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  28. [28]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  29. [29]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  30. [30]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  31. [31]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  32. [32]
    Censys RedPenguin MAR 2025

    Censys Research Team. (2025, March 14). JunOS and RedPenguin. Retrieved June 24, 2025.

    Open source URL
  33. [33]
    Censys RedPenguin MAR 2025

    Censys Research Team. (2025, March 14). JunOS and RedPenguin. Retrieved June 24, 2025.

    Open source URL
  34. [34]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  35. [35]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  36. [36]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  37. [37]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  38. [38]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  39. [39]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  40. [40]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  41. [41]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  42. [42]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  43. [43]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  44. [44]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  45. [45]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  46. [46]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  47. [47]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  48. [48]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  49. [49]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  50. [50]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  51. [51]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  52. [52]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  53. [53]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  54. [54]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  55. [55]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  56. [56]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  57. [57]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  58. [58]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  59. [59]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  60. [60]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  61. [61]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  62. [62]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  63. [63]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  64. [64]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  65. [65]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  66. [66]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  67. [67]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  68. [68]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  69. [69]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  70. [70]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  71. [71]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  72. [72]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  73. [73]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  74. [74]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  75. [75]
    Censys RedPenguin MAR 2025

    Censys Research Team. (2025, March 14). JunOS and RedPenguin. Retrieved June 24, 2025.

    Open source URL
  76. [76]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  77. [77]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  78. [78]
    Juniper RedPenguin MAR 2025

    Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.

    Open source URL
  79. [79]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  80. [80]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
  81. [81]
    Mandiant UNC3886 Juniper Routers MAR 2025

    Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use