S1203 J-magic

malwareEnterprise

platformsNetwork Devices

also known asJ-magic

J-magic is a custom variant of the cd00r backdoor tailored to target Juniper routers that was first observed during the J-magic Campaign in mid-2023. J-magic monitors TCP traffic for five predefined parameters or "magic packets" to be sent by the attackers before activating on compromised devices.

techniques used (8)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1036.005Match Legitimate Resource Name or Location
T1040Network Sniffing
T1059.004Unix Shell
T1070.003Clear Command History
T1095Non-Application Layer Protocol
T1205Traffic Signaling
T1573.002Asymmetric Cryptography

used by campaigns (1)

Campaigns that use this.

C0050J-magic Campaign

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan