New Router Backdoor Hides Its C2 in an Encrypted Mesh: Yuma Masubuchi at VB2026
A newly identified Linux backdoor runs its command-and-control over an encrypted IPv6 mesh network, so there is no fixed server IP for defenders to block.
APT groups increasingly turn hacked routers and edge devices into Operational Relay Boxes (ORBs). These relay nodes hide where attacks really come from.
The backdoor, called CJDoor, targets MIPS routers widely deployed across Europe and Asia. It is passive and builds its channel on cjdns, a legitimate encrypted mesh networking project.
In his VB2026 talk, "Hidden in the overlay: analysis of a backdoor leveraging encrypted overlay communications for ORBs", on Thursday, October 15 at 10:00 a.m., Yuma Masubuchi traces how a router becomes an ORB node.
Speaker: Yuma Masubuchi, Malware Analyst and Intelligence Analyst, JPCERT/CC
The talk breaks down how CJDoor sets up its mesh connection, including peer credentials, node keys and its TUN interface. It also compares CJDoor's message handling with the legitimate cjdns code.
A demo uses several emulated routers on one host, with one infected node sending 14 commands to another.
The research ties CJDoor to new UAT-7810 activity from August 2026, a China-nexus group that Cisco Talos has reported on. Rekoobe was found in the same infrastructure, along with an unreported variant of ShortLeash.
For defenders, the talk covers hardware-level forensics such as UART access and firmware extraction. It also explains how to identify a compromised router and respond. A C++ analysis tool is set for release.
Yuma Masubuchi is a malware and intelligence analyst in JPCERT/CC's Cyber Security Coordination Group. He investigates APT incidents across Windows, Linux, network appliances and edge devices.
He has written JPCERT research on Ivanti Connect Secure malware, CrossC2 and APT-C-60. He has also spoken at CODE BLUE and AVAR. He trains at JSAC as well.
To go deeper on the topic, start here:
- Research: Cisco Talos, "UAT-7810 continues building ORB networks using new malware", covering the LapDogs ORB network and new LEASH-family tools.
- Research: SecurityScorecard, "LapDogs Is Back", which counts more than 1,000 ShortLeash nodes.
- Research: Masubuchi on CrossC2 expanding Cobalt Strike Beacon to Linux and macOS, with a released config parser.
- Research: Masubuchi on APT-C-60 activity in 2026, covering SpyGlace along with abuse of GitHub, GitLab and Codeberg.
- Code: The legitimate cjdns project that CJDoor builds on.
Network defenders who rely on IP and domain blocklists to catch relay traffic should see why that approach breaks here.
How would your team spot a compromised edge router that never talks to a fixed C2 address?
5 points · 1 comment
Mentions
New Router Backdoor Hides Its C2 in an Encrypted Mesh: Yuma Masubuchi at VB2026 A newly identified Linux backdoor runs its command-and-control over an encrypted IPv6 mesh network, so there is no fixed server IP for defenders to block. APT groups increasingly turn hacked routers and edge devices into Operational Relay Boxes (ORBs). These relay nodes hide where attacks really come from. The backdoor, called CJDoor, targets MIPS routers widely deployed across Europe and Asia. It is passive and builds its channel on cjdns, a legitimate encrypted mesh networking project. In his VB2026 talk, "Hidden in the overlay: analysis of a backdoor leveraging encrypted overlay communications for ORBs", on Thursday, October 15 at 10:00 a.m., Yuma Masubuchi traces how a router becomes an ORB node. Speaker: Yuma Masubuchi, Malware Analyst and Intelligence Analyst, JPCERT/CC The talk breaks down how CJDoor sets up its mesh connection, including peer credentials, node keys and its TUN interface. It also compares CJDoor's message handling with the legitimate cjdns code. A demo uses several emulated routers on one host, with one infected node sending 14 commands to another. The research ties CJDoor to new UAT-7810 activity from August 2026, a China-nexus group that Cisco Talos has reported on. Rekoobe was found in the same infrastructure, along with an unreported variant of ShortLeash. For defenders, the talk covers hardware-level forensics such as UART access and firmware extraction. It also explains how to identify a compromised router and respond. A C++ analysis tool is set for release. Yuma Masubuchi is a malware and intelligence analyst in JPCERT/CC's Cyber Security Coordination Group. He investigates APT incidents across Windows, Linux, network appliances and edge devices. He has written JPCERT research on Ivanti Connect Secure malware, CrossC2 and APT-C-60. He has also spoken at CODE BLUE and AVAR. He trains at JSAC as well. To go deeper on the topic, start here: - Research: Cisco Talos, "UAT-7810 continues building ORB networks using new malware", covering the LapDogs ORB network and new LEASH-family tools. - Research: SecurityScorecard, "LapDogs Is Back", which counts more than 1,000 ShortLeash nodes. - Research: Masubuchi on CrossC2 expanding Cobalt Strike Beacon to Linux and macOS, with a released config parser. - Research: Masubuchi on APT-C-60 activity in 2026, covering SpyGlace along with abuse of GitHub, GitLab and Codeberg. - Code: The legitimate cjdns project that CJDoor builds on. Network defenders who rely on IP and domain blocklists to catch relay traffic should see why that approach breaks here. How would your team spot a compromised edge router that never talks to a fixed C2 address?