Censys Research Team. (2025, March 14). JunOS and RedPenguin. Retrieved June 24, 2025.
Not cited by any technique.
None recorded.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1078 Valid Accounts |
CampaignRedPenguin | During RedPenguin, UNC3886 used legitimate credentials to gain priviliged access to Juniper routers. |
| T1095 Non-Application Layer Protocol |
CampaignRedPenguin | During RedPenguin, UNC3886 leveraged malware that used UDP and TCP sockets for C2. |
| T1587.001 Malware |
CampaignRedPenguin | During RedPenguin, UNC3886 deployed custom malware based on the publicly-available TINYSHELL backdoor. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
