UNC3886 Threat Actor Profile Guide: Defending Hypervisors, Firewalls and Routers

UNC3886 is a China-nexus espionage group that deliberately operates on systems where endpoint detection cannot run: VMware ESXi hosts, vCenter, FortiGate firewalls and Juniper routers. Mandiant has documented the group exploiting zero-days in Fortinet and VMware products, planting backdoors in hypervisors and network operating systems, and harvesting the service account and network authentication credentials that tie infrastructure together. This profile summarises who the group is, what it targets, the ATT&CK techniques it uses, how it abuses identities, and what virtualisation and network teams should monitor and harden. It is written for defenders who run ESXi, vCenter and network devices, and for threat intelligence teams building hunts against this class of actor.

Key takeaways

• It lives below the operating system. UNC3886 targets hypervisors and network appliances because they rarely run EDR, then uses that position to reach guest machines without generating guest logon events.
• Zero-days are a habit, not an exception. Mandiant tied the group to exploitation of CVE-2022-41328 (FortiOS), CVE-2023-20867 (VMware Tools) and CVE-2023-34048 (vCenter, exploited from late 2021 before the October 2023 patch).
• Infrastructure credentials are the real prize. The group harvested vCenter's vpxuser service account, backdoored SSH clients and servers to capture passwords, and replaced a TACACS+ server binary to log plaintext network credentials.
• Anti-forensics is built in. Backdoors disable or edit logs, restore login records and hide behind rootkits such as REPTILE and MEDUSA, so evidence must be collected off-box.
• Defence is hygiene at the infrastructure layer. Patch and replace end-of-life devices, lock down hypervisor management, centralise and protect device logs, and manage infrastructure credentials as privileged non-human identities.

Who they are (names and aliases)

UNC3886 is the designation used by Mandiant (Google Threat Intelligence); "UNC" marks an uncategorised cluster that has not been merged into a numbered APT group. MITRE ATT&CK tracks it as G1048 UNC3886 and describes a China-nexus cyber espionage group active since at least 2022, targeting defence, technology and telecommunications organisations in the United States and the Asia-Pacific-Japan region, with a deep understanding of edge devices and virtualisation technologies. ATT&CK lists no other aliases. Mandiant's June 2024 report places the activity from roughly late 2021 and notes that some tooling, such as the MOPSLED backdoor, was shared with other China-nexus groups including APT41.

Treat attribution with the care any vendor cluster deserves: names map imperfectly across vendors. See the Threat Actor Naming Conventions Guide and the China State Cyber Operations Guide for context.

Targeting and motivation

The objective is long-term espionage access. Mandiant's 2024 report lists government, telecommunications, technology, aerospace and defence, and energy and utilities victims, mostly in North America, Southeast Asia and Oceania, with others in Europe, Africa and Asia. Recovered scanning logs showed interest in TCP/902 (VMware) and TCP/4786 (Cisco Smart Install) across networks the victims managed, and access to a TACACS+ server from a jump host led Mandiant to consider a supply chain angle plausible.

In March 2025 Mandiant reported that in mid-2024 the group had deployed backdoors on end-of-life Juniper MX routers, a move from the network edge into internal routing infrastructure. In July 2025 Singapore's Coordinating Minister for National Security, K. Shanmugam, said publicly that UNC3886 was attacking the country's critical infrastructure and that the Cyber Security Agency was handling it; he did not name a sponsoring state.

Tactics and techniques (MITRE ATT&CK)

The table below lists techniques ATT&CK v20 attributes to G1048 that matter most to defenders, with the procedure as documented. It is not exhaustive.

Mandiant also documented MOPSLED using a GitHub Pages dead drop and RIFLESPINE using Google Drive for command and control (T1102 Web Service), and assessed that the group moved away from them because cloud service traffic from servers stands out.

Vulnerabilities linked to the group

How they abuse identities and credentials

UNC3886 is a credential collector. Almost every stage depends on infrastructure accounts that are rarely in scope for identity governance.

• vCenter service account (vpxuser): Mandiant explains that vpxuser is created on each ESXi host when it joins vCenter, that its encrypted password sits in the vCenter database and rotates every 30 days by default, and that root on vCenter lets an attacker retrieve and crack it. ATT&CK records the group harvesting and using vCenter service accounts (T1078.001). One compromised vCenter becomes privileged access to every connected host.
• Guest access without guest credentials: with CVE-2023-20867, a compromised host could run privileged guest operations on Windows and Linux virtual machines without credentials, and Mandiant observed no Windows 4624 or 4634 logon events for that activity.
• SSH credential capture: the group modified ssh and sshd binaries to capture passwords to hidden files and used package version locking so upgrades would not overwrite them.
• Network authentication services: after a sniffer for TACACS+ (TCP/49) failed, the group replaced the TACACS+ daemon with a version that logged plaintext credentials after verification. On Juniper routers, Mandiant found initial privileged access came from a terminal server using legitimate credentials.
• Certificates and vaults: stolen FortiGate TLS certificates disguised command and control, and KeePass files were targeted for stored passwords.

The lesson for identity teams: hypervisor service accounts, TACACS+ and RADIUS secrets, router local accounts, SSH keys on jump hosts and device certificates are non-human identities with domain-wide reach. See the Non-Human Identity (NHI) Guide and the Threat Intelligence for Identity and NHI Guide.

Notable incidents

• 2022 to 2023, FortiGate and ESXi: Mandiant began investigating in September 2022 after finding malware in ESXi hypervisors, and linked FortiOS exploitation (CVE-2022-41328) to the same actor; ATT&CK attributes the THINCRUST backdoor and the CASTLETAP ICMP port knocking backdoor on FortiGate firewalls to the group, citing Mandiant.
• June 2023, VMware Tools zero-day: Mandiant published the CVE-2023-20867 guest operations bypass (VMware advisory VMSA-2023-0013) along with VMCI socket backdoors that can be reached from any guest regardless of network segmentation and are invisible to tcpdump and netstat by default.
• January 2024, vCenter zero-day: Mandiant and VMware reported exploitation of CVE-2023-34048 since late 2021. Crash entries for the vmdird service in /var/log/vMonCoredumper.log appeared minutes before backdoors were deployed, while the core dumps themselves had been deleted.
• March 2025, Juniper MX routers: six modified TINYSHELL backdoors mimicking Junos daemons, one built to stop syslog forwarding, restore login records and suppress SNMP traps and management audit logging.
• July 2025, Singapore: the government publicly named UNC3886 as attacking critical infrastructure.

Detection and defence

Hypervisors and vCenter

• Patch and track: apply VMware fixes for the CVEs above (Mandiant's guidance for CVE-2023-34048 was vCenter 8.0U2 or later) and treat vCenter and ESXi as internet-grade exposed assets in vulnerability management.
• Restrict management access: isolate ESXi and vCenter management interfaces on a dedicated network reachable only from hardened admin workstations, use lockdown mode, and keep SSH and the ESXi shell disabled except during approved maintenance.
• Enforce VIB integrity: keep the host acceptance level at a vendor-supported setting, alert on any VIB installation or acceptance level change, and enable the setting that prevents execution of binaries not installed through a signed VIB (execInstalledOnly) where your version supports it. See the VMware ESXi Hardening Guide and the VMware vCenter Server Hardening Guide.
• Hunt the indicators Mandiant published: vmdird crash entries in vMonCoredumper.log, unexpected changes to ESXi firewall allow-lists, unknown processes listening on VMCI sockets, and guest operations executed by vpxuser or root outside change windows.

Firewalls, routers and AAA

• Replace end-of-life devices: the Juniper intrusions used unsupported hardware. See the Edge Device End of Life Replacement Playbook.
• Use vendor integrity tooling: Juniper recommended upgrading to the images in advisory JSA93446 and running the Juniper Malware Removal Tool quick scan and integrity check; Fortinet devices should be checked against the vendor's advisory guidance and firmware integrity checks.
• Protect authentication servers: monitor TACACS+ and RADIUS server binaries with file integrity monitoring, and alert on changes to tac_plus or equivalent daemons.
• Validate configuration: compare device configurations to approved templates and alert on drift, as Mandiant recommends.

Logging and evidence

• Ship logs off-box in real time: forward ESXi, vCenter, firewall and router logs to a SIEM over a protected channel, and alert when a device stops sending (a gap is the signal when the actor disables forwarding).
• Preserve volatile evidence: in an investigation, capture memory and disk images of appliances and hosts before rebooting, and compare binaries against vendor hashes. See the Hypervisor and Virtualisation Security Guide.

Metrics

• Percentage of ESXi, vCenter and network devices on supported, patched versions.
• Percentage of infrastructure devices with logs reaching the SIEM in the last 24 hours, and mean time to detect a silent device.
• Number of VIB installs, acceptance level changes and SSH enablements on ESXi per month, each matched to a change record.
• Percentage of infrastructure service accounts (vpxuser excepted, which vCenter rotates) and AAA secrets rotated on schedule and stored in a vault.
• Time from KEV publication to remediation for hypervisor and network device CVEs.

Framework mapping

Practitioner checklist

• Confirm every FortiOS, vCenter, ESXi, VMware Tools and Junos instance is patched against the CVEs in this profile.
• Inventory and replace end-of-life firewalls and routers, starting with those in core routing paths.
• Put ESXi and vCenter management on an isolated network, enable lockdown mode and keep SSH off by default.
• Alert on VIB installs, acceptance level changes, ESXi firewall rule changes and vmdird crash entries.
• Place file integrity monitoring on TACACS+ and RADIUS servers and on jump hosts' SSH binaries.
• Move network device and AAA credentials into a vault with MFA and role-based access for administrators.
• Forward all infrastructure logs off-box and alert on silent devices.
• Run vendor integrity tools (such as JMRT on Junos) after patching and during any investigation.
• Prepare an incident playbook for hypervisor and appliance compromise that preserves memory and disk before reboot.

Standards and references

• MITRE ATT&CK: UNC3886 (G1048)
• Google Cloud (Mandiant): Cloaked and Covert, Uncovering UNC3886 Espionage Operations
• Google Cloud (Mandiant): VMware ESXi Zero-Day Used by Chinese Espionage Actor
• Google Cloud (Mandiant): Chinese Espionage Group UNC3886 Exploited vCenter Zero-Day Since Late 2021
• Google Cloud (Mandiant): China-Nexus Espionage Targets Juniper Routers
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5
• Eyewitness News: Singapore facing serious cyberattack, says minister

Related NHI Mgmt Group resources: Hypervisor and Virtualisation Security Guide · VMware ESXi Hardening Guide · Edge Device Exploitation by Threat Actors Guide · Salt Typhoon Threat Actor Profile · Threat Actor Groups Guide