UNC3886
UNC3886 is a China-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 10 sectors, including Government and Technology, in 11 countries, including the United States and India. It uses 99 MITRE ATT&CK techniques and exploits 13 known CVEs.
- Origin
- China
- Techniques
- 99
- Exploited CVEs
- 13
- First seen
- Nov 19, 2024
- Last seen
- Jul 28, 2025
- Record updated
Who They Target.
About UNC3886.
In March 2023, we provided details surrounding a custom malware ecosystem utilized on affected Fortinet devices. Furthermore, the investigation uncovered the compromise of VMware technologies, which facilitated access to guest virtual machines. Persistence mechanisms encompassed network devices, hypervisors, and virtual machines, ensuring alternative channels remain available even if the primary layer is detected and eliminated.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.