UNC3886

Origin🇨🇳 China

Techniques (MITRE ATT&CK)49

SourceMITRE ATT&CK

About the group

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity80

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 49

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Search Threat Vendor Data

Resource development

Malware Exploits Malware Digital Certificates

Initial access

Exploit Public-Facing Application

Execution

PowerShell Windows Command Shell Unix Shell Python Hypervisor CLI Exploitation for Client Execution ESXi Administration Command

Persistence

Boot or Logon Initialization Scripts RC Scripts vSphere Installation Bundles Compromise Host Software Binary

Privilege escalation

Exploitation for Privilege Escalation Abuse Elevation Control Mechanism

Credential access

LSASS Memory Network Sniffing Exploitation for Credential Access Password Managers

Discovery

Process Discovery File and Directory Discovery System Time Discovery Virtual Machine Discovery

Lateral movement

SSH Lateral Tool Transfer

Collection

Local Data Staging Archive via Utility Archive via Custom Method

Command and control

Fallback Channels Non-Application Layer Protocol

defense-impairment

Disable or Modify Tools Disable or Modify System Firewall Prevent Command History Logging

stealth

Rootkit Indicator Removal from Tools Masquerade Task or Service File Deletion Timestomp Clear Network Connection History and Configurations Valid Accounts Default Accounts Traffic Signaling Port Knocking Rundll32 Ignore Process Interrupts

Exploited vulnerabilities 8

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2022-42475CRITICALEPSS 99%KEV MITRE ATT&CK

CVE-2023-34048CRITICALEPSS 99%KEV MITRE ATT&CK

CVE-2023-20867LOWEPSS 14%KEV MITRE ATT&CK

CVE-2022-22948MEDIUMEPSS 13%KEV MITRE ATT&CK

CVE-2022-41328MEDIUMEPSS 11%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2019-3610MEDIUMEPSS 0% MITRE ATT&CK

References

UNC3886 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →