coldbraid

UNC3886

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.

ATT&CK ID
G1048
Origin
China
Techniques
37
Tools
8

Vulnerabilities it has exploited

Techniques

Reconnaissance

Search Threat Vendor Data

Resource Development

Develop CapabilitiesObtain Capabilities

Initial Access

Valid AccountsExploit Public-Facing Application

Execution

Command and Scripting InterpreterExploitation for Client ExecutionESXi Administration Command

Persistence

Boot or Logon Initialization ScriptsValid AccountsTraffic SignalingServer Software ComponentCompromise Host Software Binary

Privilege Escalation

Boot or Logon Initialization ScriptsExploitation for Privilege EscalationValid AccountsAbuse Elevation Control Mechanism

Stealth

RootkitObfuscated Files or InformationMasqueradingIndicator RemovalValid AccountsTraffic SignalingSystem Binary Proxy ExecutionHide Artifacts

Defense Impairment

Disable or Modify ToolsDisable or Modify System FirewallPrevent Command History Logging

Credential Access

OS Credential DumpingNetwork SniffingExploitation for Credential AccessCredentials from Password Stores

Discovery

Network SniffingProcess DiscoveryFile and Directory DiscoverySystem Time DiscoveryVirtual Machine Discovery

Lateral Movement

Remote ServicesLateral Tool Transfer

Collection

Data StagedArchive Collected Data

Command and Control

Fallback ChannelsNon-Application Layer ProtocolTraffic Signaling

Software

CASTLETAP · MEDUSA · MOPSLED · REPTILE · RIFLESPINE · THINCRUST · VIRTUALPIE · VIRTUALPITA

MITRE ATT&CKAll threat actors