Backdoor infecting VPNs used “magic packets” for stealth and security

May Be Interested In:Calgary man found guilty of raping 90-year-old woman | CBC News



When threat actors use backdoor malware to gain access to a network, they want to make sure all their hard work can’t be leveraged by competing groups or detected by defenders. One countermeasure is to equip the backdoor with a passive agent that remains dormant until it receives what’s known in the business as a “magic packet.” On Thursday, researchers revealed that a never-before-seen backdoor that quietly took hold of dozens of enterprise VPNs running Juniper Network’s Junos OS has been doing just that.

J-Magic, the tracking name for the backdoor, goes one step further to prevent unauthorized access. After receiving a magic packet hidden in the normal flow of TCP traffic, it relays a challenge to the device that sent it. The challenge comes in the form of a string of text that’s encrypted using the public portion of an RSA key. The initiating party must then respond with the corresponding plaintext, proving it has access to the secret key.

Open sesame

The lightweight backdoor is also notable because it resided only in memory, a trait that makes detection harder for defenders. The combination prompted researchers at Lumen Technology’s Black Lotus Lab to sit up and take notice.

“While this is not the first discovery of magic packet malware, there have only been a handful of campaigns in recent years,” the researchers wrote. “The combination of targeting Junos OS routers that serve as a VPN gateway and deploying a passive listening in-memory only agent, makes this an interesting confluence of tradecraft worthy of further observation.”

The researchers found J-Magic on VirusTotal and determined that it had run inside the networks of 36 organizations. They still don’t know how the backdoor got installed. Here’s how the magic packet worked:

The passive agent is deployed to quietly observe all TCP traffic sent to the device. It discreetly analyzes the incoming packets and watches for one of five specific sets of data contained in them. The conditions are obscure enough to blend in with the normal flow of traffic that network defense products won’t detect a threat. At the same time, they’re unusual enough that they’re not likely to be found in normal traffic.

share Share facebook pinterest whatsapp x print

Similar Content

Your TV Sounds Awful. These Soundbars Can Fix That.
Your TV Sounds Awful. These Soundbars Can Fix That.
Alouettes: un très gros match pour amorcer la saison 2025
Alouettes: un très gros match pour amorcer la saison 2025
'It's not acceptable when half the population is silenced': CEO of Afghan media group Moby
'It's not acceptable when half the population is silenced': CEO of Afghan media group Moby
‘Ejected from the aircraft’: Horror detail as 179 people presumed dead in South Korea plane crash
‘Ejected from the aircraft’: Horror detail as 179 people presumed dead in South Korea plane crash
Alan Brazil branded ‘dinosaur’ by talkSport co-host in women’s football debate
Alan Brazil branded ‘dinosaur’ by talkSport co-host in women’s football debate
‘How can you rebuild when your father is the worst sexual predator in decades?’: Pelicot’s daughter speaks; and Philippa Perry on the deceptive ‘spark’ – podcast
‘How can you rebuild when your father is the worst sexual predator in decades?’: Pelicot’s daughter speaks; and Philippa Perry on the deceptive ‘spark’ – podcast
Global Focus: Events that Define Our World | © 2025 | Daily News