Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

Mandiant discovered that UNC3886 deployed custom backdoors (TINYSHELL/lmpad variants) on Juniper Junos OS routers in mid-2024, using credential access to management infrastructure and a veriexec bypass via process injection (CVE-2025-21590) to achieve root access on end-of-life Juniper MX devices; the report covers malware analysis, TTPs, attribution, and recommends upgrading Juniper images and running the Juniper Malware Removal Tool (JMRT) scans.