J-magic
- ID
- S1203
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
J-magic is a custom variant of the cd00r backdoor tailored to target Juniper routers that was first observed during the J-magic Campaign in mid-2023. J-magic monitors TCP traffic for five predefined parameters or "magic packets" to be sent by the attackers before activating on compromised devices.[1]
Techniques used (8)
- T1016 System Network Configuration Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1040 Network Sniffing
- T1059.004 Unix Shell
- T1070.003 Clear Command History
- T1095 Non-Application Layer Protocol
- T1205 Traffic Signaling
- T1573.002 Asymmetric Cryptography