Threat intelligence / Group

UNC3886

[UNC3886](https://attack.mitre.org/groups/G1048) is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. [UNC3886](https://attack.mitre.org/groups/G1048) has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.(Citation: Mandiant Fortinet Zero Day)(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[UNC3886](https://attack.mitre.org/groups/G1048) is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. [UNC3886](https://attack.mitre.org/groups/G1048) has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.(Citation: Mandiant Fortinet Zero Day)(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)

58 recorded

Relationships

attributed-to

from RedPenguin

Campaign

uses

to Abuse Elevation Control Mechanism

Technique

uses

to Archive via Custom Method

Technique

uses

to Archive via Utility

Technique

uses

to Boot or Logon Initialization Scripts

Technique

uses

Malware

uses

to Clear Network Connection History and Configurations

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Default Accounts

Technique

uses

to Digital Certificates

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Disable or Modify Tools

Technique

uses

to ESXi Administration Command

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation for Credential Access

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploit Public-Facing Application

Technique

uses

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hypervisor CLI

Technique

uses

to Ignore Process Interrupts

Technique

uses

to Indicator Removal from Tools

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to LSASS Memory

Technique

uses

Technique

uses

Technique

uses

to Masquerade Task or Service

Technique

uses

Malware

uses

Malware

uses

to Network Sniffing

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Password Managers

Technique

uses

to Port Knocking

Technique

uses

Technique

uses

to Prevent Command History Logging

Technique

uses

to Process Discovery

Technique

uses

Technique

uses

Technique

uses

Malware

uses

Malware

uses

Technique

uses

Technique

uses

to Search Threat Vendor Data

Technique

uses

to SSH

Technique

uses

to System Time Discovery

Technique

uses

Malware

uses

Technique

uses

to Traffic Signaling

Technique

uses

Technique

uses

to Valid Accounts

Technique

uses

to Virtual Machine Discovery

Technique

uses

Malware

uses

Malware

uses

to vSphere Installation Bundles

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

G1048

Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/

Mandiant Fortinet Zero Day

https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem