Threat actor
UNC3886
China
Tracked by CyberSIXT since 9 Feb
- Articlesall time
- 2
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 1
- Research reportsall time
- 0
Connections
1 exploited CVE · 8 tools- Exploited CVEs
- CVE-2022-41328
- Affected vendors
- Fortinet
- Malware and tools
- VIRTUALPITA, VIRTUALPIE, REPTILE, MEDUSA, MOPSLED, RIFLESPINE, THINCRUST, CASTLETAP
Names and sources
- UNC3886
- CyberSIXT coverage, Malpedia, MISP Galaxy, MITRE ATT&CK®
Attributed facts
- Origin
China MISP Galaxy
CVEs exploited
1 CVE an article attributes to UNC3886CVE-2022-41328Fortinet FortiOS Path Traversal Vulnerability · attributed by Cyber Security Agency of Singapore (CSA), 10 Feb · Source articleCVSS6.5MediumExploited11%EPSS1article
Vendors targeted
Malware and tools
MITRE ATT&CK® · G1048 8
MITRE ATT&CK® techniques
49 techniques · 13 tacticsFrom MITRE ATT&CK® · G1048
Values by tactic
Most recorded: Stealth 12 · Persistence 8 · Execution 7
Reconnaissance1
T1681Search Threat Vendor DataResource Development4
T1587.001MalwareT1587.004ExploitsT1588.001MalwareT1588.004Digital CertificatesInitial Access3
T1078Valid AccountsT1078.001Default AccountsT1190Exploit Public-Facing ApplicationExecution7
T1059.001PowerShellT1059.003Windows Command ShellT1059.004Unix ShellT1059.006PythonT1059.012Hypervisor CLIT1203Exploitation for Client ExecutionPersistence8
T1037Boot or Logon Initialization ScriptsT1037.004RC ScriptsT1078Valid AccountsT1078.001Default AccountsT1205Traffic SignalingT1205.001Port KnockingPrivilege Escalation6
T1037Boot or Logon Initialization ScriptsT1037.004RC ScriptsT1068Exploitation for Privilege EscalationT1078Valid AccountsT1078.001Default AccountsT1548Abuse Elevation Control MechanismStealth12
T1014RootkitT1027.005Indicator Removal from ToolsT1036.004Masquerade Task or ServiceT1070.004File DeletionT1070.006TimestompT1070.007Clear Network Connection History and ConfigurationsDefense Impairment3
T1685Disable or Modify ToolsT1686Disable or Modify System FirewallT1690Prevent Command History LoggingCredential Access4
T1003.001LSASS MemoryT1040Network SniffingT1212Exploitation for Credential AccessT1555.005Password ManagersDiscovery5
T1040Network SniffingT1057Process DiscoveryT1083File and Directory DiscoveryT1124System Time DiscoveryT1673Virtual Machine DiscoveryLateral Movement2
T1021.004SSHT1570Lateral Tool TransferCollection3
T1074.001Local Data StagingT1560.001Archive via UtilityT1560.003Archive via Custom MethodCommand and Control4
T1008Fallback ChannelsT1095Non-Application Layer ProtocolT1205Traffic SignalingT1205.001Port Knocking© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- China-linked APT UNC3886 targets Singapore telcosSecurity Affairs
- China-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage CampaignThe Hacker News · first in our coverage