THE J-MAGIC SHOW: MAGIC PACKETS AND WHERE TO FIND THEM

Summary from the TLDR InfoSec newsletter

Lumen Technologies' Black Lotus Labs has been tracking a malicious campaign that targets Juniper enterprise routers. The malware is a passive agent that listens for one of five parameters sent in a “magic packet.” This post contains a technical analysis of the magic packets and indicators of compromise for threat hunters.