Juniper Networks released updates to staunch a custom backdoor installed into its Junos OS routers by a China-linked espionage group, a hack that was initially discovered last year by Google’s Mandiant Incident Response team. The patch comes as Juniper is in the process of an increasingly complex acquisition attempt by Hewlett Packard Enterprise (HPE).

Mandiant explained in a blog post that last year it discovered the UNC3886 “China-nexus espionage group” had deployed several TINYSHELL-based backdoors into Junos OS-powered routers. These backdoors included active and passive functions, and embedded scripts that disabled logging mechanisms on the device.

Mandiant explained that it worked with Juniper on the hack and found the MX routers were running “end-of-life hardware and software.”

Juniper noted that the “medium” severity vulnerability impacts all of its Junos OS products – except its Junos Evolved – that run on a variety of its routers. The vulnerability is in the Junos OS kernel and if exploited allows a local attacker with “high privileges” to inject code into a device.

The vendor admits to at least one instance of the vulnerability being exploited, though coyly notes “not at Amazon.” Mandiant did add that it has not discovered any overlap between this attack and the broader Volt Typhoon or Salt Typhoon cyberattacks.

Juniper attack shows growing sophistication Mandiant said the Juniper hack appears to have built on similar ones deployed by the same group attacking virtualization technologies and network edge devices in 2022 and 2023.

“Mandiant previously reported on UNC3886's emphasis on techniques to gather and use legitimate credentials to move laterally within a network, undetected,” the security researchers wrote. “These objectives remained consistent but were pursued with the introduction of a new tool in 2024. Observations in this blog post strengthen our assessment that the actor’s focus is on maintaining long-term access to victim networks. UNC3886 continues to show a deep understanding of the underlying technology of the appliances being targeted.”

It added that the group “continues to prioritize stealth in its operations through the use of passive backdoors, together with log and forensics artifact tampering, indicating a focus on long-term persistence, while minimizing the risk of detection.”

Will there be an HPE impact?

The latest discovery comes as Juniper Networks is in the process of being acquired by Hewlett Packard Enterprise (HPE). The Department of Justice (DOJ) recently filed a lawsuit to block the deal due to market competition concerns, with a court date scheduled for July 9.

Questions have been raised over potential national security concerns of ongoing support of critical telecommunication technologies provided by both HPE and Juniper that are used by the U.S. government. This might impact how the pending acquisition arguments plays out in court.

“If the government, whatever the agencies are, are customers, then the Department of Justice would have reached out to talk to them, so they will have a voice,” Jennifer Rie, senior litigation analyst for antitrust at Bloomberg Intelligence, recently told SDxCentral in an interview. “And if they are concerned about the security aspects, if there’s some piece of the issue here that relates to security, the DOJ will learn, and that will be part of trial. It might end up being under seal, confidential, those who listen won’t be able to hear those defenses, but it definitely may be part of it. If the government is a customer, the Department of Justice is talking to those agencies.”