Stealthy 'Magic Packet' malware targets Juniper VPN gateways

J-magic is a stealthy backdoor campaign targeting Juniper edge routers (often used as VPN gateways) that passively monitors TCP traffic using eBPF filters for a specially crafted "magic packet"; when the packet satisfies one of five conditions and correctly responds to an RSA challenge, the malware spawns a reverse shell. Black Lotus Labs observed the campaign across semiconductor, energy, manufacturing, and IT sectors between mid-2023 and mid-2024, noting the operator’s use of challenge-response and in-memory persistence to minimize detection and enable long-term access.