UNC3886

Summary

China-nexus cyberespionage group tracked by Mandiant (MITRE G1048) that targets defense, technology and telecommunication organisations in the US and Asia-Pacific through network edge devices and virtualisation platforms. Mandiant documented its zero-day exploitation of VMware vCenter (CVE-2023-34048, from late 2021), FortiOS (CVE-2022-41328), vCenter (CVE-2022-22948) and VMware Tools (CVE-2023-20867), plus exploitation of FortiOS CVE-2022-42475 in January 2023, with malicious vSphere Installation Bundles, publicly available rootkits (REPTILE, MEDUSA) and backdoored SSH binaries used to harvest credentials. In mid-2024 Mandiant found six TINYSHELL-based backdoors on end-of-life Juniper MX routers, where the actor bypassed Junos veriexec protection by injecting code into a legitimate process — the technique tracked as CVE-2025-21590. In February 2026 Singapore's CSA and IMDA disclosed Operation CYBER GUARDIAN, a response of more than eleven months to a UNC3886 campaign against all four major Singapore telcos, in which a zero-day was used to bypass a perimeter firewall and rootkits were used for persistence.

Attribution

Singapore's government named the group, not a state

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  China-nexus cyber espionage group
• Cyber Security Agency of Singapore / IMDA (Government, 2026-02-09)
  Named UNC3886 for the campaign on its telecoms sector; named no state

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 17

Exploited vulnerabilities 6

Highest CVSS first.

Infrastructure patterns

• Juniper Junos routers, incl. ISP routers, reached from terminal servers with valid credentials (Mandiant, 2025)
• GitHub Pages (cyberponke.github[.]io) and Google Drive as C2 channels for its implants (Mandiant, 2024)
• ORB-network infrastructure; victim's own TLS certificate reused from a compromised FortiGate (MITRE ATT&CK, 2026)

Reporting and advisories 5

• CSA Singapore / IMDA
  Operation CYBER GUARDIAN — multi-agency operation against UNC3886 in Singapore's telecom sector
• Mandiant
  Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers
• Mandiant
  Cloaked and Covert: Uncovering UNC3886 Espionage Operations
• MITRE ATT&CK
  UNC3886 (G1048) group profile
• Taiwan National Security Bureau
  Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025 (4 Jan 2026)