RedPenguin

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.(Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

This is a historical record and does not establish current campaign activity.

Threat actor

UNC3886

Attribution confidence

Not established

First documented activity

2024-07-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2024-07-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2025-03-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1057 · Process Discovery

  Discovery — During RedPenguin, UNC3886 used malware capable of reading the PID for the Junos OS snmpd daemon.(Citation: Juniper RedPenguin MAR 2025)

• T1040 · Network Sniffing

  Credential Access, Discovery — During RedPenguin, UNC3886 used a passive backdoor to act as a libpcap-based packet sniffer.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1587.001 · Malware

  Resource Development — During RedPenguin, UNC3886 deployed custom malware based on the publicly-available TINYSHELL backdoor.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Censys RedPenguin MAR 2025)

• T1104 · Multi-Stage Channels

  Command And Control — During RedPenguin, UNC3886 used malware with separate channels to request and carry out tasks from C2.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1059.008 · Network Device CLI

  Execution — During RedPenguin, UNC3886 accessed the Junos OS CLI on targeted devices.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1571 · Non-Standard Port

  Command And Control — During RedPenguin, UNC3886 used a backdoor that binds to port 45678 by default.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1070.007 · Clear Network Connection History and Configurations

  Stealth — During RedPenguin, UNC3886 used an implant to delete logs associated with unauthorized access to targeted Junos OS devices.(Citation: Juniper RedPenguin MAR 2025)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During RedPenguin, UNC3886 used legitimate credentials to gain priviliged access to Juniper routers.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Censys RedPenguin MAR 2025)

• T1059.004 · Unix Shell

  Execution — During RedPenguin, UNC3886 used malware capable of launching an interactive shell.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1203 · Exploitation for Client Execution

  Execution — During RedPenguin, UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1573.001 · Symmetric Cryptography

  Command And Control — During RedPenguin, UNC3886 malware used the RC4 cipher to encrypt outgoing C2 messages.(Citation: Juniper RedPenguin MAR 2025)

• T1016 · System Network Configuration Discovery

  Discovery — During RedPenguin, UNC3886 leveraged JunoOS CLI queries to obtain the interface index which contains system and network details.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1090 · Proxy

  Command And Control — During RedPenguin, UNC3886 used malware capable of establishing a SOCKS proxy connection to a specified IP and port.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During RedPenguin, UNC3886 created multiple strains of malware using names to mimic legitimate binaries such as appid, to, irad, lmpad, jdosd, and oemd.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1055 · Process Injection

  Stealth, Privilege Escalation — During RedPenguin, UNC3886 exploited CVE-2025-21590 to enable malicious code injection into the memory of legitimate processes.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During RedPenguin, UNC3886 used malware implants to deobfuscate incoming C2 messages and encoded archives.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1027.013 · Encrypted/Encoded File

  Stealth — During RedPenguin, UNC3886 generated Base64-encoded files in the FreeBSD shell environment of targeted Juniper devices.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1205 · Traffic Signaling

  Stealth, Persistence, Command And Control — During RedPenguin, UNC3886 leveraged malware capable of inpecting packets for a magic-string to activate backdoor functionalities.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1690 · Prevent Command History Logging

  Defense Impairment — During RedPenguin, UNC3886 used malware to clear the `HISTFILE` environmental variable and to inject into Junos OS processes to inhibit logging.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1105 · Ingress Tool Transfer

  Command And Control — During RedPenguin, UNC3886 used backdoor malware capable of downloading files to compromised infrastructure.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1090.003 · Multi-hop Proxy

  Command And Control — During RedPenguin, UNC3886 used infrastructure associated with operational relay box (ORB) networks.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1095 · Non-Application Layer Protocol

  Command And Control — During RedPenguin, UNC3886 leveraged malware that used UDP and TCP sockets for C2.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)(Citation: Censys RedPenguin MAR 2025)(Citation: Juniper RedPenguin MAR 2025)

• T1554 · Compromise Host Software Binary

  Persistence — During RedPenguin, UNC3886 peformed a local memory patching attack to modify the snmpd and mgd Junos OS daemons.(Citation: Juniper RedPenguin MAR 2025)

• T1070.004 · File Deletion

  Stealth — During RedPenguin, UNC3886 used malware capaple of removing scripts after execution.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1014 · Rootkit

  Stealth — During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During RedPenguin, UNC3886 uploaded specified files from compromised devices to a remote server. (Citation: Mandiant UNC3886 Juniper Routers MAR 2025)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0056

  Official MITRE ATT&CK campaign record C0056. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.