UNC3886

UNC3886 is a China-nexus, state-sponsored espionage group tracked by Mandiant. Known aliases in the provided content include Fire Ant and UNC3886. The group has targeted network infrastructure and virtualization environments, including Juniper routers, Junos OS devices, Fortinet appliances, and VMware vCenter and ESXi environments. ENISA’s 2025 Threat Landscape report noted UNC3886 among actors targeting Juniper routers and exploiting zero-day vulnerabilities in network infrastructure, and Taiwan’s NSB named UNC3886 among Chinese groups involved in sustained targeting of Taiwan’s critical sectors. The group is described as focused on long-term access, stealth, and use of legitimate credentials for lateral movement while avoiding detection. Mandiant reported UNC3886 exploited a vulnerability as a zero day for nearly two years prior to disclosure. In Junos OS intrusions, Mandiant attributed deployment of several TINYSHELL-based backdoors, including active and passive variants, and noted the use of embedded scripts to disable logging. Mandiant also reported UNC3886 activity against VMware environments, where the group deployed Linux rootkits including REPTILE and MEDUSA after exploiting vCenter and ESXi vulnerabilities. Reporting in the provided content also links UNC3886 to MEDUSA and its installer SEAELF, and to a MEDUSA/OrBit codebase configuration matching specific XOR key, credentials, and install path characteristics. Observed tradecraft in the provided content includes staging captured credentials in var/log/ldapd<unique_keyword>.2.gz; listing running processes on guest VMs from ESXi hosts; executing Windows commands on guest virtual machines through vmtoolsd.exe; timestomping ESXi hosts before installing malicious vSphere Installation Bundles; and using esxcli to remove files created by malicious VIBs from disk. During the RedPenguin campaign, UNC3886 uploaded specified files from compromised devices to a remote server, generated Base64-encoded files in the FreeBSD shell environment of targeted Juniper devices, exploited CVE-2025-21590 to enable malicious code injection into the memory of legitimate processes, performed local memory patching to modify the snmpd and mgd Junos OS daemons, trojanized Fortinet firmware, and replaced the legitimate /usr/bin/tac_plus TACACS+ daemon with a malicious credential-logging version. The group is also described as prioritizing stealth through passive backdoors and tampering with logs and forensic artifacts, and as demonstrating deep understanding of the underlying appliance technologies it targets.