CHINESE HACKERS BREACH JUNIPER NETWORKS ROUTERS WITH CUSTOM BACKDOORS AND ROOTKITS

Summary from the TLDR InfoSec newsletter

Chinese cyber espionage group UNC3886 has targeted Juniper Networks MX routers nearing end-of-life, using six TinyShell-based backdoors for file transfers, shell command execution, and log disabling. They exploit JunOS security by using legitimate credentials for privileged access and injecting malicious payloads into the memory of legitimate processes. Juniper Networks has addressed this vulnerability (CVE-2025-21590) in recent OS updates and advises organizations to upgrade their devices to the latest Juniper Malware Removal Tool versions.