EXPLORE
← Back to Actors

UNC3886

UNC3886

[UNC3886](https://attack.mitre.org/groups/G1048) is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. [UNC3886](https://attack.mitre.org/groups/G1048) has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.(Citation: Mandiant Fortinet Zero Day)(Citation: Google Cloud Threat Intelligence VMWare ESXi Ze...

52
Techniques
46
Covered
6
Gaps
88%
Coverage
Coverage46/52

COVERED (46)

T1003.001LSASS Memory111 det.T1008Fallback Channels5 det.T1014Rootkit31 det.T1021.004SSH38 det.T1027.005Indicator Removal from Tools6 det.T1036.004Masquerade Task or Service7 det.T1037Boot or Logon Initialization Scripts27 det.T1037.004RC Scripts11 det.T1040Network Sniffing15 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.004Unix Shell177 det.T1059.006Python55 det.T1059.012Hypervisor CLI9 det.T1068Exploitation for Privilege Escalation104 det.T1070.004File Deletion46 det.T1070.006Timestomp10 det.T1074.001Local Data Staging10 det.T1078Valid Accounts320 det.T1078.001Default Accounts12 det.T1083File and Directory Discovery49 det.T1095Non-Application Layer Protocol26 det.T1124System Time Discovery4 det.T1190Exploit Public-Facing Application240 det.T1203Exploitation for Client Execution81 det.T1205Traffic Signaling1 det.T1205.001Port Knocking1 det.T1212Exploitation for Credential Access12 det.T1218.011Rundll3278 det.T1505.006vSphere Installation Bundles1 det.T1548Abuse Elevation Control Mechanism105 det.T1554Compromise Host Software Binary19 det.T1555.005Password Managers4 det.T1560.001Archive via Utility27 det.T1562.001Disable or Modify Tools332 det.T1562.003Impair Command History Logging3 det.T1562.004Disable or Modify System Firewall50 det.T1570Lateral Tool Transfer23 det.T1587.001Malware10 det.T1588.001Malware2 det.T1588.004Digital Certificates1 det.T1673Virtual Machine Discovery4 det.T1685Disable or Modify Tools281 det.T1686Disable or Modify System Firewall19 det.T1690Prevent Command History Logging3 det.