Lumen J-Magic JAN 2025

J-magic can compare the host and remote IPs to check if a received packet is from the infected machine.

During the J-magic Campaign, threat actors used the name “JunoscriptService” to masquerade malware as the Junos automation scripting service.

J-magic can rename itself as “[nfsiod 0]” to masquerade as the local Network File System (NFS) asynchronous I/O server.

J-magic has a pcap listener function that can create an Extended Berkley Packet Filter (eBPF) on designated interfaces and ports.

The J-magic agent is executed through a command line argument which specifies an interface and listening port.

J-magic can overwrite previously executed command line arguments.

J-magic can monitor incoming C2 communications sent over TCP to the compromised host.

cd00r can monitor incoming C2 communications sent over TCP to the compromised host.

J-magic can monitor TCP traffic for packets containing one of five different predefined parameters and will spawn a reverse shell if one of the parameters and the proper response string to a subsequent challenge is received.

cd00r can monitor for a single TCP-SYN packet to be sent in series to a configurable set of ports (200, 80, 22, 53 and 3 in the original code) before opening a port for communication.

J-magic can communicate back to send a challenge to C2 infrastructure over SSL.

During the J-magic Campaign, threat actors acquired VPS for use in C2.

During the J-magic Campaign, threat actors used self-signed certificates on VPS C2 infrastructure.

During the J-magic Campaign campaign, threat actors used open-source malware post-compromise including a custom variant of the cd00r backdoor.