UNC3886

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which lack EDR support. Their ability to manipulate firewall firmware and exploit a zero-day indicates they have curated a deeper-level of understanding of such technologies. UNC3886 has modified publicly available malware, specifically targeting *nix operating systems.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1008 Fallback Channels T1014 Rootkit T1021.004 SSH T1027.005 Indicator Removal from Tools T1036.004 Masquerade Task or Service T1037 Boot or Logon Initialization Scripts T1037.004 RC Scripts T1040 Network Sniffing T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.006 Python T1059.012 Hypervisor CLI T1068 Exploitation for Privilege Escalation T1070.004 File Deletion T1070.006 Timestomp T1070.007 Clear Network Connection History and Configurations T1074.001 Local Data Staging T1078 Valid Accounts T1078.001 Default Accounts T1083 File and Directory Discovery T1095 Non-Application Layer Protocol T1124 System Time Discovery T1190 Exploit Public-Facing Application T1203 Exploitation for Client Execution T1205 Traffic Signaling T1205.001 Port Knocking T1212 Exploitation for Credential Access T1218.011 Rundll32 T1505.006 vSphere Installation Bundles T1548 Abuse Elevation Control Mechanism T1554 Compromise Host Software Binary T1555.005 Password Managers T1560.001 Archive via Utility T1560.003 Archive via Custom Method T1564.011 Ignore Process Interrupts T1570 Lateral Tool Transfer T1587.001 Malware T1587.004 Exploits T1588.001 Malware T1588.004 Digital Certificates T1673 Virtual Machine Discovery T1675 ESXi Administration Command T1681 Search Threat Vendor Data T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall T1690 Prevent Command History Logging

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.