Procedure examples

During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.

During RedPenguin, UNC3886 leveraged JunoOS CLI queries to obtain the interface index which contains system and network details.

During RedPenguin, UNC3886 generated Base64-encoded files in the FreeBSD shell environment of targeted Juniper devices.

During RedPenguin, UNC3886 created multiple strains of malware using names to mimic legitimate binaries such as appid, to, irad, lmpad, jdosd, and oemd.

During RedPenguin, UNC3886 used a passive backdoor to act as a libpcap-based packet sniffer.

During RedPenguin, UNC3886 uploaded specified files from compromised devices to a remote server.

During RedPenguin, UNC3886 exploited CVE-2025-21590 to enable malicious code injection into the memory of legitimate processes.

During RedPenguin, UNC3886 used malware capable of reading the PID for the Junos OS snmpd daemon.

During RedPenguin, UNC3886 used malware capable of launching an interactive shell.

During RedPenguin, UNC3886 accessed the Junos OS CLI on targeted devices.

During RedPenguin, UNC3886 used malware capaple of removing scripts after execution.

During RedPenguin, UNC3886 used an implant to delete logs associated with unauthorized access to targeted Junos OS devices.

During RedPenguin, UNC3886 used legitimate credentials to gain priviliged access to Juniper routers.

During RedPenguin, UNC3886 used malware capable of establishing a SOCKS proxy connection to a specified IP and port.

During RedPenguin, UNC3886 used infrastructure associated with operational relay box (ORB) networks.

During RedPenguin, UNC3886 leveraged malware that used UDP and TCP sockets for C2.

During RedPenguin, UNC3886 used malware with separate channels to request and carry out tasks from C2.

During RedPenguin, UNC3886 used backdoor malware capable of downloading files to compromised infrastructure.

During RedPenguin, UNC3886 used malware implants to deobfuscate incoming C2 messages and encoded archives.

During RedPenguin, UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.

During RedPenguin, UNC3886 leveraged malware capable of inpecting packets for a magic-string to activate backdoor functionalities.

During RedPenguin, UNC3886 peformed a local memory patching attack to modify the snmpd and mgd Junos OS daemons.

During RedPenguin, UNC3886 used a backdoor that binds to port 45678 by default.

During RedPenguin, UNC3886 malware used the RC4 cipher to encrypt outgoing C2 messages.

During RedPenguin, UNC3886 deployed custom malware based on the publicly-available TINYSHELL backdoor.

During RedPenguin, UNC3886 used malware to clear the `HISTFILE` environmental variable and to inject into Junos OS processes to inhibit logging.