MITRE ATT&CKsoftware (malware)
S1203 J-magic
- Domain
- enterprise
- Platforms
- Network Devices
- Version
- 1.0
- Created
- 2025-02-18
Description
J-magic is a custom variant of the cd00r backdoor tailored to target Juniper routers that was first observed during the J-magic Campaign in mid-2023. J-magic monitors TCP traffic for five predefined parameters or "magic packets" to be sent by the attackers before activating on compromised devices.
Related
Uses · MITRE ATT&CK (8)
- T1573.002 Asymmetric Cryptography sub-technique
- T1059.004 Unix Shell sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.003 Clear Command History sub-technique
- T1205 Traffic Signaling technique
- T1016 System Network Configuration Discovery technique
- T1040 Network Sniffing technique
- T1095 Non-Application Layer Protocol technique
Referenced by MITRE ATT&CK · uses (1)
- C0050 J-magic Campaign campaign
References
- https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/ Lumen J-Magic JAN 2025