UNC3886
- ID
- G1048
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]
Techniques used (49)
- T1003.001 LSASS Memory
- T1008 Fallback Channels
- T1014 Rootkit
- T1021.004 SSH
- T1027.005 Indicator Removal from Tools
- T1036.004 Masquerade Task or Service
- T1037 Boot or Logon Initialization Scripts
- T1037.004 RC Scripts
- T1040 Network Sniffing
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1059.006 Python
- T1059.012 Hypervisor CLI
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1078.001 Default Accounts
- T1083 File and Directory Discovery
- T1095 Non-Application Layer Protocol
- T1124 System Time Discovery
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1205 Traffic Signaling
- T1205.001 Port Knocking
- T1212 Exploitation for Credential Access
- T1218.011 Rundll32
- T1505.006 vSphere Installation Bundles
- T1548 Abuse Elevation Control Mechanism
- T1554 Compromise Host Software Binary
- T1555.005 Password Managers
- T1560.001 Archive via Utility
- T1560.003 Archive via Custom Method
- T1564.011 Ignore Process Interrupts
- T1570 Lateral Tool Transfer
- T1587.001 Malware
- T1587.004 Exploits
- T1588.001 Malware
- T1588.004 Digital Certificates
- T1673 Virtual Machine Discovery
- T1675 ESXi Administration Command
- T1681 Search Threat Vendor Data
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1690 Prevent Command History Logging
Software used (8)
- S1217 VIRTUALPITA
- S1218 VIRTUALPIE
- S1219 REPTILE
- S1220 MEDUSA
- S1221 MOPSLED
- S1222 RIFLESPINE
- S1223 THINCRUST
- S1224 CASTLETAP