MITRE ATT&CKcampaign

C0056 RedPenguin

Published 2025-06-24 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2025-06-24

Description

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.

Related

Attributed to · MITRE ATT&CK (1)

Uses · MITRE ATT&CK (28)

  • T1690 Prevent Command History Logging technique
  • S1219 REPTILE software (malware)
  • S1220 MEDUSA software (malware)
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1070.007 Clear Network Connection History and Configurations sub-technique
  • T1059.008 Network Device CLI sub-technique
  • T1587.001 Malware sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1571 Non-Standard Port technique
  • T1059.004 Unix Shell sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1070.004 File Deletion sub-technique
  • T1203 Exploitation for Client Execution technique
  • T1205 Traffic Signaling technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1014 Rootkit technique
  • T1016 System Network Configuration Discovery technique
  • T1040 Network Sniffing technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1078 Valid Accounts technique
  • T1090 Proxy technique
  • T1095 Non-Application Layer Protocol technique
  • T1104 Multi-Stage Channels technique
  • T1105 Ingress Tool Transfer technique

References