H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[REPTILE](https://attack.mitre.org/software/S1219) is an open-source Linux rootkit with multiple components that provides backdoor access and functionality.(Citation: Google Cloud Mandiant UNC3886 2024)

Labels

malware

13 recorded

Relationships

uses

from RedPenguin

Campaign

uses

to Asymmetric Cryptography

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Hidden Files and Directories

Technique

uses

to Kernel Modules and Extensions

Technique

uses

to Launch Daemon

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Port Knocking

Technique

uses

to Rootkit

Technique

uses

to Traffic Signaling

Technique

uses

to Udev Rules

Technique

uses

to Unix Shell

Technique

uses

from UNC3886

Group

2 external

References

mitre-attack

S1219

open

Google Cloud Mandiant UNC3886 2024

https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations

open