J-magic — Malware Profile

J-magic is a custom variant of the cd00r backdoor tailored to target Juniper routers that was first observed during the J-magic Campaign in mid-2023. J-magic monitors TCP traffic for five predefined parameters or "magic packets" to be sent by the attackers before activating on compromised devices.

MITRE ATT&CK techniques (8)

• T1016 System Network Configuration Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1040 Network Sniffing
• T1059.004 Unix Shell
• T1070.003 Clear Command History
• T1095 Non-Application Layer Protocol
• T1205 Traffic Signaling
• T1573.002 Asymmetric Cryptography

Read the full analysis on IntelFusions