Tag: ghosttown

1 Attack Reports | 0 Vulnerabilities

Attack reports

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

China-nexus espionage group UNC3886 has been discovered deploying custom backdoors on Juniper Networks' Junos OS routers. The attackers used TINYSHELL-based backdoors with varying capabilities, including active and passive functions, and an embedded script to disable logging. The group demonstrated…
espionage
persistence
medusa
backdoors
routers
gobrat
china-nexus
2025-03-12
reptile
tinyshell
pithook
network infrastructure
juniper
seaelf
busybox
ghosttown
Published: March 12, 2025
Downloadable IOCs: 13
Click here to see more Attack Reports