H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

MOPSLED

[MOPSLED](https://attack.mitre.org/software/S1221) is a shellcode-based modular backdoor that has been used by China-nexus cyber espionage actors including [UNC3886](https://attack.mitre.org/groups/G1048) and [APT41](https://attack.mitre.org/groups/G0096).(Citation: Google Cloud Mandiant UNC3886 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[MOPSLED](https://attack.mitre.org/software/S1221) is a shellcode-based modular backdoor that has been used by China-nexus cyber espionage actors including [UNC3886](https://attack.mitre.org/groups/G1048) and [APT41](https://attack.mitre.org/groups/G0096).(Citation: Google Cloud Mandiant UNC3886 2024)

Labels

malware
8 recorded

Relationships

uses
from APT41
Group
uses
to Dead Drop Resolver
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to Encrypted/Encoded File
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Web Protocols
Technique
uses
to Web Service
Technique
uses
from UNC3886
Group
2 external

References

mitre-attack
S1221
open
Google Cloud Mandiant UNC3886 2024
https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance