D
CyberChina

UNC3886

Suspected state-linked cyber threat groupTrackedPending verification
CyberCHN
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeSuspected state-linked cyber threat group
ProliferationOrigin country only
Active since2022At least 2022Med[1]
MITRE ATT&CK IDG1048High[1]
Capabilities
ATT&CK techniques used49ATT&CK v20.1High[1]
Malware and toolsCASTLETAP, MEDUSA, MOPSLED, REPTILE, RIFLESPINE, THINCRUST, VIRTUALPIE, VIRTUALPITA8 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorChina-nexusMed[1]
TargetsUNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions.Med[1]
Notable activityRedPenguin (C0056, 2024–2025)Med[1]
Notes
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
China
Sources
  1. UNC3886, Group G1048, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1048)