Threat Actor 🇨🇳 China

UNC3886

UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which lack EDR support. Their ability to manipulate firewall firmware and exploit a zero-day indicates they have curated a deeper-level of understanding of such technologies. UNC3886 has modified publicly available malware, specifically targeting *nix operating systems.

Indicators of Compromise 10

Domain mail[.]io Domain openmail[.]pro Domain tutamail[.]com Filename /bin/fgfm Filename attacker-cert3 Filename backdoor-ssh Filename helpdesk IP 1[.]2[.]3[.]4 IP 144[.]31[.]1[.]252 IP 8[.]8[.]8[.]8

MITRE ATT&CK TTPs 10

T1021.001
Remote Desktop Protocol
Lateral Movement
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1078.002
Domain Accounts
Defense Evasion
 T1098.002
Additional Email Delegate Permissions
Persistence
 T1110.001
Password Guessing
Credential Access
 T1136.001
Local Account
Persistence
 T1543.001
Launch Agent
Persistence
 T1556.004
Network Device Authentication
Credential Access
 T1566
Phishing
Initial Access

Source Articles

Opening the Black Box: Agentless Threat Detection for Virtual Appliances
FortiGate virtual appliances are being actively targeted by multiple threat actors due to their internet-facing nature and elevated privileges. Attackers exploit vulnerabilities such as CVE-2026-24858, CVE-2024-55591, and CVE-2022-41328 to gain access, create backdoor accounts, manipulate certificates, and establish lateral movement. These activities are often obscured by log deletion and weak configurations, making detection difficult without agentless visibility.
wiz