UNC3886
Overview
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.
Naming & attribution
It uses 49 documented ATT&CK techniques — more than 83% of the 174 groups tracked here. Activity attributed since at least 2022.
Distinctive techniques
Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.
T1059.012Hypervisor CLI — used by 1 of 174 groupsT1212Exploitation for Credential Access — used by 1 of 174 groupsT1505.006vSphere Installation Bundles — used by 1 of 174 groupsT1548Abuse Elevation Control Mechanism — used by 1 of 174 groupsT1673Virtual Machine Discovery — used by 1 of 174 groupsT1675ESXi Administration Command — used by 1 of 174 groupsT1070.007Clear Network Connection History and Configurations — used by 2 of 174 groupsT1205.001Port Knocking — used by 2 of 174 groups
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- APT5 China — 13 shared techniques (20% overlap)
- Play — 11 shared techniques (17% overlap)
- Lazarus Group North Korea — 18 shared techniques (15% overlap)
- APT41 China — 17 shared techniques (15% overlap)
- APT3 China — 12 shared techniques (15% overlap)
- Aquatic Panda China — 11 shared techniques (15% overlap)
Malware families with tracked indicators
One family attributed to UNC3886, with 46 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.
- Medusa46 indicators
Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.
Capabilities
- Exploitation of public-facing / client applications — ATT&CK T1190, T1203, T1212
- Custom malware/implant development — ATT&CK: 8 attributed custom malware families
TTPs — 49 techniques across 13 tactics
Reconnaissance
Resource Development
T1587.001MalwareT1587.004ExploitsT1588.001MalwareT1588.004Digital Certificates
Initial Access
Execution
T1059.001PowerShellT1059.003Windows Command ShellT1059.004Unix ShellT1059.006PythonT1059.012Hypervisor CLIT1203Exploitation for Client ExecutionT1675ESXi Administration Command
Persistence
T1037Boot or Logon Initialization ScriptsT1037.004RC ScriptsT1505.006vSphere Installation BundlesT1554Compromise Host Software Binary
Privilege Escalation
Stealth
T1014RootkitT1027.005Indicator Removal from ToolsT1036.004Masquerade Task or ServiceT1070.004File DeletionT1070.006TimestompT1070.007Clear Network Connection History and ConfigurationsT1078Valid AccountsT1078.001Default AccountsT1205Traffic SignalingT1205.001Port KnockingT1218.011Rundll32T1564.011Ignore Process Interrupts
Defense Impairment
Credential Access
T1003.001LSASS MemoryT1040Network SniffingT1212Exploitation for Credential AccessT1555.005Password Managers
Discovery
Lateral Movement
T1021.004SSHT1570Lateral Tool Transfer
Collection
T1074.001Local Data StagingT1560.001Archive via UtilityT1560.003Archive via Custom Method
Command and Control
Tools & malware (8)
MOPSLED · VIRTUALPIE · CASTLETAP · THINCRUST · VIRTUALPITA · REPTILE · MEDUSA · RIFLESPINE
Reporting (2)
- VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors — Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown
- Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation — Marvi, A. et al.