threat actor

UNC3886

unknownentity:threat_actor

UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which lack EDR support. Their ability to manipulate firewall firmware and exploit a zero-day indicates they have curated a deeper-level of understanding of such technologies. UNC3886 has modified publicly available malware, specifically targeting *nix operating system

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: unc3886
kind: threat actor
status: unknown
aliases: —
jurisdictions: —
claims naming it: 0 · 0 attributions · 8 relations · 0 events

Identifiers

attack G1048via mitre-attack
misp-galaxy 8c08dbe7-3ed0-4d7d-b315-22d8774a5bd9via misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatUNC3886usesMOPSLED
fetch —sha256 dc1639caa5501d72
rel_220btcintel:relations:220@v1 sha256:367b501ab3ca389a
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatUNC3886usesVIRTUALPIE
fetch —sha256 dc1639caa5501d72
rel_221btcintel:relations:221@v1 sha256:d253766e61687e31
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatUNC3886usesCASTLETAP
fetch —sha256 dc1639caa5501d72
rel_222btcintel:relations:222@v1 sha256:f2c1ddf68988bd99
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatUNC3886usesTHINCRUST
fetch —sha256 dc1639caa5501d72
rel_223btcintel:relations:223@v1 sha256:cf649194fdfc4e4c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatUNC3886usesVIRTUALPITA
fetch —sha256 dc1639caa5501d72
rel_224btcintel:relations:224@v1 sha256:5b175b97eeb15ce1
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatUNC3886usesREPTILE
fetch —sha256 dc1639caa5501d72
rel_225btcintel:relations:225@v1 sha256:b9908409cab3e076
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatUNC3886usesmedusa
fetch —sha256 dc1639caa5501d72
rel_226btcintel:relations:226@v1 sha256:759a8dcf4e7a4e50
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatUNC3886usesRIFLESPINE
fetch —sha256 dc1639caa5501d72
rel_227btcintel:relations:227@v1 sha256:6e2a7d3c4cdaffd0
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.