Thursday 15 October 10:00 - 10:30, Green room
Yuma Masubuchi (JPCERT/CC)
In recent years, compromised edge devices and routers have increasingly been abused by APT actors as Operational Relay Boxes (ORBs), providing infrastructure that helps conceal attacker activity and sustain long-term operations. The ORBs and malware discussed in this presentation target routers and related platforms that are widely deployed across regions including Europe and Asia, making them a significant potential threat in these regions as well.
In this presentation, we introduce CJDoor, a newly identified Linux backdoor that uses cjdns, an encrypted mesh network, as its command-and-control infrastructure, as well as new attack activity observed in August 2026 involving UAT-7810, a threat actor previously reported by Cisco Talos. We also present a previously unreported variant of ShortLeash, discuss router forensic techniques for hunting these threats on compromised devices, and introduce malware analysis tools developed during our investigation.
CJDoor targets the MIPS architecture and includes functionality for turning compromised devices into part of an attacker-controlled communications infrastructure. Through reverse engineering of the CJDoor binary and its associated kernel components, we uncovered the malware's internal architecture, command protocol, and cryptographic mechanisms. Unlike conventional Linux backdoors, CJDoor is a highly unusual passive backdoor that employs an encrypted overlay network as its C2 communications infrastructure. In this presentation, we analyse the design and internal implementation of cjdns, which forms the foundation of this communications architecture, and explain how CJDoor configures cjdns on compromised routers and other devices to join an encrypted overlay network operated by the attacker. Specifically, we demonstrate the initial configuration process using peer information and authentication credentials, the generation of node keys and IPv6 addresses, the establishment of encrypted peer-to-peer communications, the configuration of TUN interfaces, and the mechanisms used for traffic forwarding. We also explain CJDoor's different operating modes, its internal architecture in which functionality is separated across multiple processes, and the differences in message framing and Control_Header handling between the cjdns implementation used by CJDoor and legitimate cjdns. By tracing these components together, we reveal the complete lifecycle through which a compromised router becomes integrated into the attacker's overlay network and begins functioning as an ORB. We further discuss how this communications model – where traffic is encrypted and direct connections to fixed C2 servers are not required – affects traditional detection approaches that rely primarily on IP addresses and domain names. As part of the presentation, we demonstrate CJDoor in a controlled environment by using multiple QEMU instances to reproduce a CJDoor-based ORB environment on a single host. We show how one node participating in the encrypted cjdns overlay network can communicate with another node and execute 14 malicious commands implemented by CJDoor. This demonstration allows us to reproduce and observe CJDoor's command-and-control behaviour over the encrypted overlay network.
In addition to our analysis of CJDoor, we present findings on Rekoobe, which we identified within the same infrastructure, as well as a previously unreported variant of ShortLeash, which has previously been reported as malware used by UAT-7810. We provide a technical comparison with previously known UAT-7810-related malware and discuss, from a technical perspective, what these findings reveal about changes and evolution in the actor's ORB infrastructure.
Based on the knowledge gained through this investigation, we also introduce techniques for detecting and mitigating these threats. Conventional endpoint forensic techniques can be difficult to apply to compromised routers, so we additionally cover a hardware-level forensic approach in which devices are accessed via UART and firmware or storage images are extracted for analysis. We demonstrate how these forensic techniques can be incorporated into real-world investigations and discuss practical approaches for identifying router compromise, conducting initial incident response, and mitigating these threats.
We will also release a C++-based malware analysis support tool developed as part of this research.
Through this presentation, attendees will gain a detailed understanding of the internal architecture of CJDoor and other malware associated with UAT-7810, as well as how compromised routers join attacker-controlled cjdns networks and operate as nodes within an ORB infrastructure. Attendees will also gain practical technical knowledge applicable to malware analysis, detection, defence, forensic investigation, and incident response.
 |
Yuma Masubuchi Yuma Masubuchi is a malware analyst and intelligence analyst in the Cyber Security Coordination Group at JPCERT/CC. He investigates APT-related incidents and analyses malware. His research covers targeted attacks against Windows, Linux, network appliances, and edge devices. He has presented his work at international cybersecurity conferences, including CODE BLUE and AVAR. He also serves as a trainer for the JSAC, sharing practical techniques for malware analysis, threat intelligence, and incident investigation. |
Back to VB2026 conference page