Threat intelligence / Campaign

RedPenguin

The [RedPenguin](https://attack.mitre.org/campaigns/C0056) project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. [RedPenguin](https://attack.mitre.org/campaigns/C0056) activity was separately attributed to [UNC3886](https://attack.mitre.org/groups/G1048) and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.(Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

The [RedPenguin](https://attack.mitre.org/campaigns/C0056) project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. [RedPenguin](https://attack.mitre.org/campaigns/C0056) activity was separately attributed to [UNC3886](https://attack.mitre.org/groups/G1048) and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.(Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

29 recorded

Relationships

attributed-to

Group

uses

to Clear Network Connection History and Configurations

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploitation for Client Execution

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Malware

uses

to Multi-hop Proxy

Technique

uses

to Multi-Stage Channels

Technique

uses

to Network Device CLI

Technique

uses

to Network Sniffing

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Port

Technique

uses

to Prevent Command History Logging

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

Technique

uses

Malware

uses

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Traffic Signaling

Technique

uses

Technique

uses

to Valid Accounts

Technique

3 external

References

mitre-attack

C0056

Juniper RedPenguin MAR 2025

https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1

Mandiant UNC3886 Juniper Routers MAR 2025

https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers