Forensia CTI Core

Profile

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.

MITRE ATT&CK ↗

Techniques

49 ATT&CK techniques attributed to this actor.

T1003.001 LSASS Memory T1008 Fallback Channels T1014 Rootkit T1021.004 SSH T1027.005 Indicator Removal from Tools T1036.004 Masquerade Task or Service T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1040 Network Sniffing T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.006 Python T1059.012 Hypervisor CLI T1068 Exploitation for Privilege Escalation T1070.004 File Deletion T1070.006 Timestomp T1070.007 Clear Network Connection History and Configurations T1074.001 Local Data Staging T1078 Valid Accounts T1078.001 Default Accounts T1083 File and Directory Discovery T1095 Non-Application Layer Protocol T1124 System Time Discovery T1190 Exploit Public-Facing Application T1203 Exploitation for Client Execution T1205 Traffic Signaling T1205.001 Port Knocking T1212 Exploitation for Credential Access T1218.011 Rundll32 T1505.006 vSphere Installation Bundles T1548 Abuse Elevation Control Mechanism T1554 Compromise Host Software Binary T1555.005 Password Managers T1560.001 Archive via Utility T1560.003 Archive via Custom Method T1564.011 Ignore Process Interrupts T1570 Lateral Tool Transfer T1587.001 Malware T1587.004 Exploits T1588.001 Malware T1588.004 Digital Certificates T1673 Virtual Machine Discovery T1675 ESXi Administration Command T1681 Search Threat Vendor Data T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall T1690 Prevent Command History Logging

Software

8 malware/tools attributed to this actor.

VIRTUALPITAVIRTUALPIEREPTILEMEDUSAMOPSLEDRIFLESPINETHINCRUSTCASTLETAP

Related corpus activity

9,399 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to UNC3886.

Indicator	Type	Family	Sev	Src
cve-2026-3102	cve	—	85	3
cve-2026-1969	cve	—	85	1
cve-2013-3307	cve	—	85	2
cve-2014-2321	cve	—	85	1
cve-2025-34117	cve	—	85	1
cve-2021-29441	cve	—	85	1
cve-2025-66478	cve	—	85	2
cve-2021-27076	cve	—	85	1
cve-2016-15047	cve	—	85	4
cve-2018-8007	cve	—	85	1
cve-2020-17456	cve	—	85	1
cve-2025-2492	cve	—	85	2
cve-2013-7471	cve	—	85	1
cve-2021-25646	cve	—	85	1
cve-2022-47945	cve	—	85	1
cve-2016-5681	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2026-22584	cve	—	85	2
cve-2025-11837	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2025-34054	cve	—	85	4
cve-2024-1781	cve	—	85	1
cve-2023-44976	cve	ransomware	85	2
cve-2021-4045	cve	—	85	1
cve-2020-22653	cve	—	85	2
cve-2020-22658	cve	—	85	2
cve-2026-4368	cve	ransomware	85	1
cve-2017-18377	cve	—	85	1
cve-2025-23304	cve	—	85	2
cve-2026-0740	cve	—	85	1

Showing the top 30 by severity of 9,399.