UNC3886 Deploys Firmware Rootkit on Juniper MX Routers via Zero-Day

Tuesday, March 31, 2026 at 10:00 AM UTC·Source: Mandiant

Updated: Wednesday, April 1, 2026 at 06:00 AM UTC

Executive Summary

UNC3886 exploits Juniper Junos zero-day to deploy firmware-level rootkits on MX-series routers. Implant survives software upgrades and factory resets.

Analysis

Mandiant identified UNC3886 exploiting CVE-2026-29001 in Juniper Junos OS to install firmware-level rootkits on MX-series routers used by ISPs and large enterprises. The implant, dubbed TinyShell.Router, intercepts and exfiltrates network traffic while maintaining persistence across software upgrades. Discovery came during an IR engagement at a European telecom.

Timeline

Discovered

Mar 20, 2026

Exploitation Detected

Mar 20, 2026

Published

Mar 31, 2026

Indicators of Compromise (1)

CVE (1)

CVE-2026-29001

NVD MITRE CVE

Source Attribution

Originally published by Mandiant on Mar 31, 2026. Verified by: Mandiant, CISA, Juniper.

Related Threats

LOWZero Day

EvilTokens abuses Microsoft device code flow for account takeovers

A new phishing-as-a-service (PhaaS) campaign is abusing Microsoft’s device code authentication flow to gain unauthorized access to user accounts. Sekoia researchers first spotted the toolkit “EvilTokens” that lets attackers capture authentication tokens by tricking users into completing a legitimate login process in Microsoft’s own environment. The activity, observed since at least mid-February, r

16h agoCSO Online

CRITICALZero Day

Cybersecurity in the age of instant software

AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: “instant software.” Taken to an extreme, it might become easier for a user to have an AI write an application on demand — a spreadsheet, for example — and delete it when you’re done using it than to buy one commercially. Future systems could include a

20h agoCSO Online

CRITICALZero Day

Hackers exploit TrueConf zero-day to push malicious software updates

Hackers have targeted TrueConf conference servers in attacks that exploit a zero-day vulnerability, allowing them to execute arbitrary files on all connected endpoints. [...]

1d agoBleepingComputer