← threatfilter.dev / all groups / UNC3886

UNC3886

Overview

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1190, T1203, T1212
Custom malware/implant development — ATT&CK: 8 attributed custom malware families

TTPs — 49 techniques across 13 tactics

Reconnaissance

T1681 Search Threat Vendor Data

Resource Development

T1587.001 Malware
T1587.004 Exploits
T1588.001 Malware
T1588.004 Digital Certificates

Discovery

Lateral Movement

T1021.004 SSH
T1570 Lateral Tool Transfer

Collection

Command and Control

T1008 Fallback Channels
T1095 Non-Application Layer Protocol

Tools & malware (8)

MOPSLED · VIRTUALPIE · CASTLETAP · THINCRUST · VIRTUALPITA · REPTILE · MEDUSA · RIFLESPINE

Reporting (2)

VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors — Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown
Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation — Marvi, A. et al.

Overview

Capabilities

TTPs — 49 techniques across 13 tactics

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment