RedPenguin
Campaign · ATTACK:enterprise:C0056
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0056",
"title": "RedPenguin",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0056",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--35879bf3-0a21-4cc1-9e42-6de917a22501",
"external_id": "C0056",
"domain": "enterprise",
"created": "2025-06-24T15:14:52.789Z",
"modified": "2026-07-31T18:47:19.448Z",
"version": "1.0",
"aliases": [
"RedPenguin"
],
"tactics": [
],
"source_references": [
{
"source_name": "Juniper RedPenguin MAR 2025",
"url": "https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"
},
{
"source_name": "Mandiant UNC3886 Juniper Routers MAR 2025",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"
}
]
}Explicit source assertions (29)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06f0aaf3-c2ff-4d54-8279-2e7f66b5d819
Juniper RedPenguin MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ff45d1d-6095-4e5a-ae11-df8c1d336b57
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--203b1d92-99d0-4ec7-98ae-e72d148e030d
Censys RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--338559ba-2fd5-4677-8308-69aed36b5865
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:S1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3395c92f-8d9b-4aea-9001-07ad42f318d2
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → attributed-to → ATTACK:enterprise:G1048
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cde6cab-a70e-45d3-b1e5-a7a6ba08241e
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1059.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--415b324e-351f-448f-b99f-3f3d28ace516
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--554b85dc-40d2-47ac-9ba5-90765feb4e8e
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1070.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b8bded7-ea8c-45e4-8888-1ed2a6d1e134
Juniper RedPenguin MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c1083c2-68fe-475a-b3b9-cc0641ab2c4b
Censys RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74520dc9-2793-40a8-a2b6-b38e6d7c37fc
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--767ac715-7f6e-4bde-9112-2876102f8a2f
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76c24fde-66fe-47f8-95f1-49deee5df54b
Juniper RedPenguin MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a7c6567-1177-4ead-9fba-d6c1d3fc719b
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--887fda04-92e9-4819-bf6c-5458348cc046
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9862c41f-f2fe-4178-af9d-903b17c48c14
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a49898fe-a9a0-4e90-9b9e-235d82f2fea7
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:S1220
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7506333-1a9f-46e0-b0d5-8f16840627c9
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd33f6b4-ff04-49d9-81ea-275a86222a97
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc7777a5-c717-4d3b-8fb2-337da4b6403a
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df4f6956-07d1-49ec-bc7f-b1b1bfd7a244
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1690
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e26e5630-45ab-4fb7-be13-8d4b80ef68fe
Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e383e519-98df-44af-8131-a1009f4023bc
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e40578ef-e703-428e-874d-6fcee8a32d2f
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e506c970-b916-4107-9f52-133b2e1b4e6f
Censys RedPenguin MAR 2025 · Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9ee370f-d437-4030-8b26-00f0f66020e4
Juniper RedPenguin MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7ec6d79-a087-48c4-8c83-da8e2f02849e
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9a7a71f-9b10-409d-9eb9-3768bd44b744
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbaf4c59-a846-49cc-bb53-84c85e501884
Mandiant UNC3886 Juniper Routers MAR 2025