Black 'Magic' Targets Enterprise Juniper Routers With Backdoor

A campaign named "J-magic" deploys a revived cd00r backdoor on Juniper enterprise routers (notably VPN gateways and devices with exposed NETCONF) that remains dormant until triggered by one of several highly specific "magic" TCP packets; upon validation via an encrypted challenge, the backdoor spawns a reverse shell to an attacker-controlled host, enabling data theft, configuration manipulation, and lateral movement. Infections have been observed since September 2023 with most cases in spring–summer 2024 across multiple countries and industries; the technique is stealthy because edge devices typically lack EDR and standard telemetry, creating a visibility blind spot.