A Chinese Cyber Espionage Group Targeted Juniper Routers

UNC3886 had already gained notoriety for exploiting vulnerabilities in Fortinet edge devices

On March 12, 2025, Mandiant teams revealed their mid-2024 discovery of backdoors in Juniper Networks routers, installed by the Chinese cyber espionage group UNC3886. This state-backed entity had previously gained notoriety for exploiting vulnerabilities in Fortinet edge devices.

In this case, the cybercriminals took advantage of a security flaw affecting Juniper Networks’ Junos OS routers. “The backdoors had varying custom capabilities, including active and passive backdoor functions, as well as an embedded script that disables logging mechanisms on the targeted device,” the Mandiant report states.

Cybersecurity researchers also detail the “tactics, techniques, and procedures” employed by UNC3886. The Chinese group primarily targets network perimeter devices, which often lack security solutions. With a remarkable ability to move laterally within IT systems undetected, UNC3886 appears to prioritize “maintaining long-term access to its victims’ networks.”