H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

THINCRUST

[THINCRUST](https://attack.mitre.org/software/S1223) is a Python-based backdoor tool that has been used by [UNC3886](https://attack.mitre.org/groups/G1048) since at least 2023.(Citation: Mandiant Fortinet Zero Day)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[THINCRUST](https://attack.mitre.org/software/S1223) is a Python-based backdoor tool that has been used by [UNC3886](https://attack.mitre.org/groups/G1048) since at least 2023.(Citation: Mandiant Fortinet Zero Day)

Labels

malware
6 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Disable or Modify System Firewall
Technique
uses
to Python
Technique
uses
to Symmetric Cryptography
Technique
uses
to Web Protocols
Technique
uses
from UNC3886
Group
2 external

References

mitre-attack
S1223
open
Mandiant Fortinet Zero Day
https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance