Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · UNC3886 · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

UNC3886

MITRE G1048 ↗

UNC3886 — ATT&CK roseUN

attack rose · 49 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE6 new CVEs: CVE-2022-22948, CVE-2022-41328, CVE-2022-42475, CVE-2023-20867, CVE-2023-34048, CVE-2025-21590

Analyst brief

misp-galaxy + mitre-attack

UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which lack EDR support. Their ability to manipulate firewall firmware and exploit a zero-day indicates they have curated a deeper-level of understanding of such technologies. UNC3886 has modified publicly available malware, specifically targeting *nix operating systems.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

49 techniques · 13 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    4 techniques

  3. Initial access

    1 technique

  4. Execution

    7 techniques

  5. Persistence

    4 techniques

  6. Privilege escalation

    2 techniques

  7. Stealth

    12 techniques

  8. Defense impairment

    3 techniques

  9. Credential access

    4 techniques

  10. Discovery

    4 techniques

  11. Lateral movement

    2 techniques

  12. Collection

    3 techniques

  13. Command and control

    2 techniques

select a technique

Arsenal

8 malware
Malware
Malware · 8ATT&CK
MOPSLEDS1221 ↗
VIRTUALPIES1218 ↗
CASTLETAPS1224 ↗
THINCRUSTS1223 ↗
VIRTUALPITAS1217 ↗
REPTILES1219 ↗
MEDUSAS1220 ↗
RIFLESPINES1222 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to UNC3886

none on KEV
  1. CVE-2023-208672026-10-17
    1. “As investigations into UNC3886 activity continued in 2023, Mandiant discovered that the attacker utilized a zero-day vulnerability, CVE-2023-20867, to execute commands and transfer files to and from guest VMs from a compromised ESXi host without the need for guest credentials.”

      cited as exploiting · source: cloud.google.com ↗ · 2026-10-17

    2. “UNC3886 has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2025-215902026-10-17
    1. “During RedPenguin , UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.”

      cited as used in a campaign · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2022-229482026-10-17
    1. “UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2022-424752026-10-17
    1. “UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2023-340482026-10-17
    1. “UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  6. CVE-2022-413282026-10-17
    1. “UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

6 sources
  1. 1.mandiant.com/resources/blog/fortinet-malware-ecosystem
  2. 2.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence
  3. 3.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass
  4. 4.mandiant.com/resources/blog/vmware-detection-containment-hardening
  5. 5.attack.mitre.org/groups/G1048
  6. 6.cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-b…

Track UNC3886 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.