The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]
26
TechniquesTop 23%
11
TacticsTop 23%
2
Tools & malware63rd pct
1
Threat groupunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
During RedPenguin, UNC3886 created multiple strains of malware using names to mimic legitimate binaries such as appid, to, irad, lmpad, jdosd, and oemd.8
During RedPenguin, UNC3886 uploaded specified files from compromised devices to a remote server. 10
Exfiltration16 detection rules
Standing C0056
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques26Top 23%
77th percentile · 77% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics11Top 23%
77th percentile · 77% of 56 ATT&CK campaigns have this many tactics spanned or fewer.
Tools & malware263rd pct
63rd percentile · 63% of 56 ATT&CK campaigns have this many tools and malware or fewer.
Threat group155% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique11med32nd pct
32nd percentile · 68% of 56 ATT&CK campaigns have more detection rules per technique.
Tests / technique3.5med71st pct
71st percentile · 71% of 56 ATT&CK campaigns have this many atomic tests per technique or fewer.
Data comps / technique5med43% tie · 7 values
43% of the population shares a single value across only 7 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique2medTop 16%
84th percentile · 84% of 56 ATT&CK campaigns have this many mitigations per technique or fewer.
6 of 8 axes carry an honest rank on this page. Coverage medians are taken across this campaign’s 26 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
2022-08-11
2022-08-18
6f583da0-3a90-4566-a4ed-83c09fe18bbf
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.
Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
2022-06-01
—
248649b7-d64f-46f0-9fb2-a52774166fb5
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)
The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. (...)
This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. (...)
This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. (...)
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. (...)
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)