J-magic Backdoor: Juniper Routers Under Attack by Magic Packet Exploit

Juniper Networks, a key provider of enterprise-grade networking solutions, has become the focal point of a sophisticated cyber campaign labeled “J-magic.” The campaign leverages a custom backdoor to exploit a “magic packet” vulnerability within Junos OS-based routers, posing significant threats to critical sectors worldwide.

The J-magic Backdoor

According to Black Lotus Labs at Lumen Technologies, the J-magic campaign derives its name from the backdoor’s mechanism: it actively monitors incoming TCP traffic for a “magic packet”—a unique signal sent by the threat actor. Once received, the backdoor initiates further malicious activities. This type of malware targeting Junos OS, an operating system rooted in FreeBSD, is relatively rare but highly concerning due to its potential impact on enterprise-grade routers.

Campaign Timeline and Scope

The earliest known sample of the J-magic backdoor dates back to September 2023, with the campaign’s activity persisting from mid-2023 through mid-2024. Targets include high-profile sectors such as semiconductors, energy, manufacturing, and information technology (IT). Victims have been reported across multiple regions, including Europe, Asia, and South America. Affected countries span Argentina, Armenia, Brazil, Chile, Colombia, Indonesia, the Netherlands, Norway, Peru, the United Kingdom, the United States, and Venezuela.

Technical Insights

The campaign involves the deployment of an agent after an initial compromise, though the exact entry method remains unknown. This agent is a variant of “cd00r,” a backdoor that has been publicly available for nearly 25 years. It relies on stealth, operating outside the conventional listening TCP/UDP ports, thus evading traditional network scans.

The J-magic backdoor requires five pre-defined parameters embedded in the magic packet to initiate its operations. Upon receiving these parameters, the agent sends a secondary challenge back to the attacker. If the challenge is validated, a reverse shell is established to the IP address and port specified in the magic packet. This reverse shell grants attackers the ability to execute commands, exfiltrate data, or deploy additional payloads on the compromised router.

Lumen suggests that the inclusion of the secondary challenge adds a layer of exclusivity, preventing other threat actors from hijacking the compromised devices for their own purposes. This design indicates a level of operational sophistication aimed at maintaining control over the infected routers.

Comparison with Related Campaigns

While the J-magic campaign has drawn comparisons to earlier malware such as SEASPY—a cd00r variant used against Barracuda Email Security Gateway appliances in late 2022—no direct evidence links the two campaigns. Additionally, there is no overlap with other router-targeting operations like Jaguar Tooth or BlackTech (also known as Canary Typhoon). However, these incidents collectively highlight the increasing interest of threat actors in compromising edge infrastructure.

Targeting Juniper Routers

The majority of potentially affected devices are Juniper routers functioning as VPN gateways. A smaller subset includes routers with exposed NETCONF ports, which are often used for automating configuration and management tasks. The strategic targeting of such devices underscores their value to attackers, particularly nation-state actors. Long uptime, limited endpoint detection and response (EDR) protections, and critical positioning within enterprise networks make these routers prime targets for exploitation.

Implications

This campaign emphasizes the persistent risks associated with edge infrastructure. Attackers view these devices as lucrative entry points for follow-on attacks due to their critical role in network operations and their inherent vulnerabilities.

According to Lumen Technologies, “One of the most notable aspects of the campaign is the focus on Juniper routers. While we have seen heavy targeting of other networking equipment, this campaign demonstrates that attackers can find success expanding to other device types such as enterprise-grade routers.”