UNC3886 (G1048) | Threat Actor Index

49

Techniques

8

Toolsets

3

CVEs Referenced

1

KEV Entries

CISA Known Exploited

About UNC3886

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.

View MITRE record ↗

Techniques by Tactic (49)

Reconnaissance

T1681 Search Threat Vendor Data

Resource Development

T1587.001 MalwareT1587.004 ExploitsT1588.001 MalwareT1588.004 Digital Certificates

Initial Access

T1078 Valid AccountsT1078.001 Default AccountsT1190 Exploit Public-Facing Application

Execution

T1059.001 PowerShellT1059.003 Windows Command ShellT1059.004 Unix ShellT1059.006 PythonT1059.012 Hypervisor CLIT1203 Exploitation for Client ExecutionT1675 ESXi Administration Command

Persistence

T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1078 Valid AccountsT1078.001 Default AccountsT1205 Traffic SignalingT1205.001 Port KnockingT1505.006 vSphere Installation BundlesT1554 Compromise Host Software Binary

Privilege Escalation

T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.001 Default AccountsT1548 Abuse Elevation Control Mechanism

Stealth

T1014 RootkitT1027.005 Indicator Removal from ToolsT1036.004 Masquerade Task or ServiceT1070.004 File DeletionT1070.006 TimestompT1070.007 Clear Network Connection History and ConfigurationsT1078 Valid AccountsT1078.001 Default AccountsT1205 Traffic SignalingT1205.001 Port KnockingT1218.011 Rundll32T1564.011 Ignore Process Interrupts

Defence Impairment

T1685 Disable or Modify ToolsT1686 Disable or Modify System FirewallT1690 Prevent Command History Logging

Credential Access

T1003.001 LSASS MemoryT1040 Network SniffingT1212 Exploitation for Credential AccessT1555.005 Password Managers

Discovery

T1040 Network SniffingT1057 Process DiscoveryT1083 File and Directory DiscoveryT1124 System Time DiscoveryT1673 Virtual Machine Discovery

Lateral Movement

T1021.004 SSHT1570 Lateral Tool Transfer

Collection

T1074.001 Local Data StagingT1560.001 Archive via UtilityT1560.003 Archive via Custom Method

Command & Control

T1008 Fallback ChannelsT1095 Non-Application Layer ProtocolT1205 Traffic SignalingT1205.001 Port Knocking

Toolsets (8)

🐛

CASTLETAP S1224

Malware · Network Devices

🐛

MEDUSA S1220

Malware · Linux

🐛

MOPSLED S1221

Malware · Linux

🐛

REPTILE S1219

Malware · Linux

🐛

RIFLESPINE S1222

Malware · Linux

🐛

THINCRUST S1223

Malware · Network Devices

🐛

VIRTUALPIE S1218

Malware · ESXi

🐛

VIRTUALPITA S1217

Malware · ESXi, Linux

CVEs Referenced (3 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

CVE-2019-3610View full details on NVD

References & Reports (2)

↑