UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.12
- Mandiant Fortinet Zero Day
- Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | UNC3886 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1681 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.012 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1554 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1673 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.011 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1212 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1675 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.007 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1690 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1040 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1205.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1095 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1205 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1008 | 2025 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1008 | Fallback Channels | — |
| T1014 | Rootkit | — |
| T1021.004 | SSH | — |
| T1027.005 | Indicator Removal from Tools | — |
| T1036.004 | Masquerade Task or Service | — |
| T1037 | Boot or Logon Initialization Scripts | — |
| T1037.004 | RC Scripts | — |
| T1040 | Network Sniffing | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1059.006 | Python | — |
| T1059.012 | Hypervisor CLI | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1070.007 | Clear Network Connection History and Configurations | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1078.001 | Default Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1095 | Non-Application Layer Protocol | — |
| T1124 | System Time Discovery | — |
| T1190 | Exploit Public-Facing Application | — |
| T1203 | Exploitation for Client Execution | — |
| T1205 | Traffic Signaling | — |
| T1205.001 | Port Knocking | — |
| T1212 | Exploitation for Credential Access | — |
| T1218.011 | Rundll32 | — |
| T1505.006 | vSphere Installation Bundles | — |
| T1548 | Abuse Elevation Control Mechanism | — |
| T1554 | Compromise Host Software Binary | — |
| T1555.005 | Password Managers | — |
| T1560.001 | Archive via Utility | — |
| T1560.003 | Archive via Custom Method | — |
| T1564.011 | Ignore Process Interrupts | — |
| T1570 | Lateral Tool Transfer | — |
| T1587.001 | Malware | — |
| T1587.004 | Exploits | — |
| T1588.001 | Malware | — |
| T1588.004 | Digital Certificates | — |
| T1673 | Virtual Machine Discovery | — |
| T1675 | ESXi Administration Command | — |
| T1681 | Search Threat Vendor Data | — |
| T1685 | Disable or Modify Tools | — |
| T1686 | Disable or Modify System Firewall | — |
| T1690 | Prevent Command History Logging | — |
Aliases
UNC3886
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.