Início / Grupos de ameaça / UNC3886
UNC3886 G1048
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
6
CVEs associadas
62
Técnicas
8
Malwares e ferramentas
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.
Operações de ransomware ligadas a este grupo ransomware.live
medusa via MEDUSAVulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
CVE-2025-21590
Média · 4.4
KEV Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
“RedPenguin: During RedPenguin, UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.”
“UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.”
“UNC3886 has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.”
CVE-2022-42475
Crítica · 9.8
KEV Ransomware Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
“UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.”
“UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.”
CVE-2022-22948
Média · 6.5
KEV VMware vCenter Server Incorrect Default File Permissions Vulnerability
“UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.”
Técnicas por tática
Reconhecimento
T1681 Search Threat Vendor Data Desenvolvimento de recursos
T1587.001 MalwareT1587.004 ExploitsT1588.001 MalwareT1588.004 Digital Certificates Acesso inicial
T1078 Valid AccountsT1078.001 Default AccountsT1190 Exploit Public-Facing Application Execução
T1059.001 PowerShellT1059.003 Windows Command ShellT1059.004 Unix ShellT1059.006 PythonT1059.012 Hypervisor CLIT1203 Exploitation for Client ExecutionT1675 ESXi Administration Command Persistência
T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1078 Valid AccountsT1078.001 Default AccountsT1205 Traffic SignalingT1205.001 Port KnockingT1505.006 vSphere Installation BundlesT1554 Compromise Host Software Binary Escalada de privilégios
T1037 Boot or Logon Initialization ScriptsT1037.004 RC ScriptsT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.001 Default AccountsT1548 Abuse Elevation Control Mechanism Furtividade
T1014 RootkitT1027.005 Indicator Removal from ToolsT1036.004 Masquerade Task or ServiceT1070.004 File DeletionT1070.006 TimestompT1070.007 Clear Network Connection History and ConfigurationsT1078 Valid AccountsT1078.001 Default AccountsT1205 Traffic SignalingT1205.001 Port KnockingT1218.011 Rundll32T1564.011 Ignore Process Interrupts Comprometimento de defesas
T1685 Disable or Modify ToolsT1686 Disable or Modify System FirewallT1690 Prevent Command History Logging Acesso a credenciais
T1003.001 LSASS MemoryT1040 Network SniffingT1212 Exploitation for Credential AccessT1555.005 Password Managers Descoberta
T1040 Network SniffingT1057 Process DiscoveryT1083 File and Directory DiscoveryT1124 System Time DiscoveryT1673 Virtual Machine Discovery Movimento lateral
T1021.004 SSHT1570 Lateral Tool Transfer Coleta
T1074.001 Local Data StagingT1560.001 Archive via UtilityT1560.003 Archive via Custom Method Comando e controle
T1008 Fallback ChannelsT1095 Non-Application Layer ProtocolT1205 Traffic SignalingT1205.001 Port Knocking Malwares e ferramentas
- CASTLETAPMalwareS1224
- MEDUSAMalwareS1220
- MOPSLEDMalwareS1221
- REPTILEMalwareS1219
- RIFLESPINEMalwareS1222
- THINCRUSTMalwareS1223
- VIRTUALPIEMalwareS1218
- VIRTUALPITAMalwareS1217
© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.