Threat intelligence / Malware

J-magic

[J-magic](https://attack.mitre.org/software/S1203) is a custom variant of the [cd00r](https://attack.mitre.org/software/S1204) backdoor tailored to target Juniper routers that was first observed during the [J-magic Campaign](https://attack.mitre.org/campaigns/C0050) in mid-2023. [J-magic](https://attack.mitre.org/software/S1203) monitors TCP traffic for five predefined parameters or "magic packets" to be sent by the attackers before activating on compromised devices.(Citation: Lumen J-Magic JAN 2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[J-magic](https://attack.mitre.org/software/S1203) is a custom variant of the [cd00r](https://attack.mitre.org/software/S1204) backdoor tailored to target Juniper routers that was first observed during the [J-magic Campaign](https://attack.mitre.org/campaigns/C0050) in mid-2023. [J-magic](https://attack.mitre.org/software/S1203) monitors TCP traffic for five predefined parameters or "magic packets" to be sent by the attackers before activating on compromised devices.(Citation: Lumen J-Magic JAN 2025)

Labels

malware

9 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Clear Command History

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Network Sniffing

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Traffic Signaling

Technique

uses

Technique

uses

from J-magic Campaign

Campaign

2 external

References

mitre-attack

S1203

Lumen J-Magic JAN 2025

https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/