Chinese cyberspies backdoor Juniper routers for stealthy access

Mandiant discovered that UNC3886 (a China-linked espionage actor) deployed six TinyShell-derived backdoors on end-of-life Juniper MX routers in mid‑2024 by injecting malicious code into trusted processes to bypass Junos OS Veriexec protections; the backdoors provided remote shells, packet-sniffing, network-activated access, and logging disabling, with unique C2 methods and IoCs—Mandiant and Juniper recommend replacing unsupported devices, applying mitigations, and enforcing IAM/MFA, and published detection rules and IoCs.