Enterprise Juniper routers subjected to malware campaign

Summary: Black Lotus Labs documented a campaign called J-Magic that placed a custom backdoor on enterprise Juniper routers and waited for specially crafted network traffic before opening remote access.

How J-Magic works

The malware is based on the open-source cd00r backdoor and passively inspects normal TCP traffic for one of several predefined “magic packet” patterns. After receiving the correct signal and completing a challenge-response exchange, the implant opens a reverse shell that allows the operator to control the compromised router.

Who was targeted

Researchers observed the campaign from mid-2023 into 2024. Victims included organizations in manufacturing, semiconductor, energy and information-technology sectors, primarily in Europe and South America. About half of the affected routers served as VPN gateways, making them valuable positions for credential theft or movement into internal networks.

Why it matters

Routers and other edge devices often lack endpoint-security agents and may receive less detailed monitoring than servers. A passive implant that waits for a precise trigger can remain quiet and avoid generating obvious outbound traffic until the attacker is ready.

Practical takeaway

• Keep Junos OS and management components on supported, patched releases.
• Restrict administrative access and disable services that are not required.
• Monitor configuration changes, unexpected binaries and unusual reverse-shell traffic.
• Review VPN gateways as high-value security assets, not merely network appliances.

Original sources: Lumen Black Lotus Labs — The J-Magic Show: Magic Packets and Where to Find Them; SC Media — Enterprise Juniper routers subjected to malware campaign

Independently summarized and reviewed by CNB Telecom. Last reviewed: September 4, 2026.