UNC3886

UNC3886 is an advanced persistent threat group believed to have links to China. It was first publicly identified in 2023, and it has been active since at least late 2021, targeting critical IT infrastructure worldwide.

History

Mandiant reported UNC3886 in 2023 after attacks on virtual and network security systems worldwide, linking its activities to state-sponsored espionage. In 2024, Singapore confirmed that the group was targeting its critical information infrastructure, with attacks continuing into July 2025.

Notable campaigns

VMware and Fortinet Campaigns (2022–2023)

UNC3886 exploited unknown flaws in FortiGate and VMware systems to gain access, install backdoors, and spread through company networks.

Juniper Routers (Mid‑2024 / 2025)

In 2024–2025, UNC3886 used TinyShell malware to attack outdated Juniper MX routers, hide its activity, and maintain access even after the system reboots.

Fire Ant Campaign (Early 2025)

In early 2025, Sygnia linked the Fire Ant campaign to UNC3886 due to similar tools and targets. The campaign exploited VMware vulnerabilities to install backdoors.

Reactions

• China’s embassy in Singapore denied media reports linking UNC3886 to China.