UNC3886· China

UNC3886 is an advanced cyber espionage group targeting firewall and virtualization technologies without EDR support.

Analyst brief

UNC3886 is an advanced cyber espionage group. They primarily target firewall and virtualization technologies lacking EDR support. Their TTPs include exploiting public-facing applications, using custom malware (e.g., VIRTUALPITA, MOPSLED), and executing commands via Hypervisor CLI. Defenders should monitor for default account usage in ESXi environments, non-standard C2 protocols (Non-Application Layer Protocol), and script-based discovery activities.

UNC3886

unknown

UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which lack EDR support. Their ability to manipulate firewall firmware and exploit a zero-day indicates they have curated a deeper-level of understanding of such technologies. UNC3886 has modified publicly available malware, specifically targeting *nix operating systems.

origin (suspected)

China

techniques · ATT&CK

Search Threat Vendor Data Malware Exploit Public-Facing Application Hypervisor CLI ESXi Administration Command Compromise Host Software Binary Exploitation for Privilege Escalation Indicator Removal from Tools+8

malware

MOPSLED VIRTUALPIE CASTLETAP THINCRUST VIRTUALPITA REPTILE+2

source: misp-galaxy + mitre-attackG1048 6 refs →

Kill-chain playbook13

01
reconnaissance
T1681
Monitor network traffic and system logs for searching threat vendor data.
02
resource-development
T1587.001
Monitor suspicious files and processes for developing and using malware.
03
initial-access
T1190
Monitor network and system logs for exploit attempts on public-facing applications.
04
execution
T1059.012 T1675
Monitor system logs and command history for executing Hypervisor CLI and ESXi administration commands.
05
persistence
T1554
Monitor system files and processes for modifying host software binaries.
06
privilege-escalation
T1068
Monitor system logs and privilege escalation activity for exploitation attempts.
07
stealth
T1027.005 T1078.001
Monitor system logs and user activity for removing indicators from tools and using default accounts.
08
credential-access
T1212
Monitor system logs and credential access activity for exploitation attempts.
09
discovery
T1083 T1673
Monitor system logs and file system activity for file and directory discovery and virtual machine discovery.
10
lateral-movement
T1570
Monitor network traffic and system logs for lateral tool transfer.
11
collection
T1074.001
Monitor system logs and file system activity for local data staging.
12
command-and-control
T1095
Monitor network traffic and system logs for non-application layer protocol.
13
defense-impairment
T1690
Monitor system logs and command history for preventing command history logging.

FAQ2

What kind of technologies does UNC3886 primarily target?

UNC3886 primarily targets firewall and virtualization technologies that lack EDR support.

What signals should defenders look for to detect UNC3886 activity?

Defenders should monitor for default account usage in ESXi environments, non-standard C2 protocols (Non-Application Layer Protocol), and script-based discovery activities.

UNC3886· China

Analyst brief

UNC3886

Kill-chain playbook13

reconnaissance

resource-development

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

defense-impairment

FAQ2

See also5

UNC3886· China

Analyst brief

UNC3886

Kill-chain playbook13

reconnaissance

resource-development

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

defense-impairment

FAQ2

See also5