Summary

In July 2024, the Juniper Cybersecurity R&D team received a report from the field regarding a potential malware infection of a set of MX Series routers. The team launched a project – codenamed RedPenguin – with the following goals:

1. confirm that the routers were impacted by malicious software implants;
2. understand the malware designs and implementations;
3. assess how the malware was able to run on Junos OS routers, which are protected with the veriexec runtime integrity subsystem;
4. formulate recommendations to minimize the malware risk.

Customers are advised to review the attached PDF document to familiarize themselves with the details of this issue.

To assist customers and others to identify the implants, hashes for each of the malware binaries are available in the Malware Analysis section of the attached document. Additionally, Junos OS includes the Juniper Malware Removal Tool (JMRT), which can be used on the router host to scan for the malwares. See Juniper Malware Removal Tool

Please refer to JSA93446 [juniper.net]

2025-03-12: Initial Publication

2025-03-12/2: Fixed the link to the Juniper Malware Removal Tool web page

• The RedPenguin Malware Incident
• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team