UNC3886Threat actor
UNC3886 is an advanced cyber espionage group with unique capabilities in how they operate on-network as well as the tools they utilize in their campaigns. UNC3886 has been observed targeting firewall and virtualization technologies which lack EDR support.From MISP Galaxy
Last reported 18 days ago, by The Hacker News3 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1684Social Engineering
“Spring Ring campaign: A hacking group has targeted more than 150 employees across at least 10 companies as part of a coordinated social engineering campaign.”
- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1027.017SVG Smuggling
“SVG smuggling campaign: Kaseya's INKY team has spotted a massive email spam campaign using SVG smuggling to assemble a phishing page right in the user's browser.”
- T1110.003Password Spraying
“AWS password spraying campaign: A password spraying campaign has targeted the root user accounts of AWS tenants.”
- T1195Supply Chain Compromise
“In regards to cybercrime, we noted a Rust crates supply-chain compromise via typosquatted dependency, with infrastructure overlapping with operations attributed to North Korea-linked threat actors.”
- T1505.003Web Shell
“Activity spanned over 100 countries and led to confirmed compromises, including administrative takeovers and web shell deployments, enabling follow-on access and potential credential theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan“Interestingly, the use of TinyShell has been previously attributed to China-nexus clusters like Liminal Panda, UNC3886 (aka Fire Ant), and Velvet Ant, all of which have singled out telecom networks and edge devices.”
-
Cyber Brief 26-09 - August 2026“On August 27, Sygnia reported that Fire Ant, an adversary assessed to overlap with China-nexus cluster UNC3886, expanded its operations beyond hypervisors into trusted network infrastructure.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“UNC3886's FireAnt campaign evolves: A cyber-espionage group tracked as UNC3886 has continued to be active in 2026 after its initial exposure last year.”
Indicators in its reports
named in the reports above- zet[.]netin 1 report
- www.virtualizor[.]comin 1 report
- eldomador.bsky[.]socialin 1 report
- infosec[.]exchangein 1 report
- mx.zxopfds[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.