Home / Threat actors / UNC3886
UNC3886 G1048
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
6
associated CVEs
62
Techniques
8
Malware and tools
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.
Ransomware operations linked to this group ransomware.live
medusa via MEDUSAExploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
CVE-2025-21590
Medium · 4.4
KEV Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
“RedPenguin: During RedPenguin, UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.”
“UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.”
“UNC3886 has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.”
CVE-2022-42475
Critical · 9.8
KEV Ransomware Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
“UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.”
“UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.”
CVE-2022-22948
Medium · 6.5
KEV VMware vCenter Server Incorrect Default File Permissions Vulnerability
“UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.”
Techniques by tactic
Reconnaissance
T1681 Search Threat Vendor Data Resource Development
T1587.001 MalwareT1587.004 ExploitsT1588.001 MalwareT1588.004 Digital Certificates Initial Access
T1078 Valid AccountsT1078.001 Default AccountsT1190 Exploit Public-Facing Application Execution
T1059.001 PowerShellT1059.003 Windows Command ShellT1059.004 Unix ShellT1059.006 PythonT1059.012 Hypervisor CLIT1203 Exploitation for Client ExecutionT1675 ESXi Administration Command Persistence
T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1078 Valid AccountsT1078.001 Default AccountsT1205 Traffic SignalingT1205.001 Port KnockingT1505.006 vSphere Installation BundlesT1554 Compromise Host Software Binary Privilege Escalation
T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.001 Default AccountsT1548 Abuse Elevation Control Mechanism Stealth
T1014 RootkitT1027.005 Indicator Removal from ToolsT1036.004 Masquerade Task or ServiceT1070.004 File DeletionT1070.006 TimestompT1070.007 Clear Network Connection History and ConfigurationsT1078 Valid AccountsT1078.001 Default AccountsT1205 Traffic SignalingT1205.001 Port KnockingT1218.011 Rundll32T1564.011 Ignore Process Interrupts Defense Impairment
T1685 Disable or Modify ToolsT1686 Disable or Modify System FirewallT1690 Prevent Command History Logging Credential Access
T1003.001 LSASS MemoryT1040 Network SniffingT1212 Exploitation for Credential AccessT1555.005 Password Managers Discovery
T1040 Network SniffingT1057 Process DiscoveryT1083 File and Directory DiscoveryT1124 System Time DiscoveryT1673 Virtual Machine Discovery Lateral Movement
T1021.004 SSHT1570 Lateral Tool Transfer Collection
T1074.001 Local Data StagingT1560.001 Archive via UtilityT1560.003 Archive via Custom Method Command and Control
T1008 Fallback ChannelsT1095 Non-Application Layer ProtocolT1205 Traffic SignalingT1205.001 Port Knocking Malware and tools
- CASTLETAPMalwareS1224
- MEDUSAMalwareS1220
- MOPSLEDMalwareS1221
- REPTILEMalwareS1219
- RIFLESPINEMalwareS1222
- THINCRUSTMalwareS1223
- VIRTUALPIEMalwareS1218
- VIRTUALPITAMalwareS1217
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.