G1048 · ATT&CK 20.0 group
UNC3886
Aliases: UNC3886
[UNC3886](https://attack.mitre.org/groups/G1048) is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. [UNC3886](https://attack.mitre.org/groups/G1048) has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.(Citation: Mandiant Fortinet Zero Day)(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)
Aliases: UNC3886
ATT&CK techniques
T1003.001T1008T1014T1021.004T1027.005T1036.004T1037T1037.004T1040T1057T1059.001T1059.003T1059.004T1059.006T1059.012T1068T1070.004T1070.006T1070.007T1074.001T1078T1078.001T1083T1095T1124T1190T1203T1205T1205.001T1212T1218.011T1505.006T1548T1554T1555.005T1560.001T1560.003T1564.011T1570T1587.001T1587.004T1588.001T1588.004T1673T1675T1681T1685T1686T1690
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1008 Fallback Channels simulation — Exact active technique ID
- T1008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1014 Rootkit simulation — Exact active technique ID
- T1014 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.004 SSH simulation — Exact active technique ID
- T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.005 Indicator Removal from Tools simulation — Exact active technique ID
- T1027.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.004 Masquerade Task or Service simulation — Exact active technique ID
- T1036.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037 Boot or Logon Initialization Scripts simulation — Exact active technique ID
- T1037 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037.004 RC Scripts simulation — Exact active technique ID
- T1037.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1040 Network Sniffing simulation — Exact active technique ID
- T1040 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.006 Python simulation — Exact active technique ID
- T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.012 Hypervisor CLI simulation — Exact active technique ID
- T1059.012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.006 Timestomp simulation — Exact active technique ID
- T1070.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.007 Clear Network Connection History and Configurations simulation — Exact active technique ID
- T1070.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.001 Default Accounts simulation — Exact active technique ID
- T1078.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1095 Non-Application Layer Protocol simulation — Exact active technique ID
- T1095 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1124 System Time Discovery simulation — Exact active technique ID
- T1124 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1205 Traffic Signaling simulation — Exact active technique ID
- T1205 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1205.001 Port Knocking simulation — Exact active technique ID
- T1205.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1212 Exploitation for Credential Access simulation — Exact active technique ID
- T1212 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.006 vSphere Installation Bundles simulation — Exact active technique ID
- T1505.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1548 Abuse Elevation Control Mechanism simulation — Exact active technique ID
- T1548 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1554 Compromise Host Software Binary simulation — Exact active technique ID
- T1554 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.005 Password Managers simulation — Exact active technique ID
- T1555.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.003 Archive via Custom Method simulation — Exact active technique ID
- T1560.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.011 Ignore Process Interrupts simulation — Exact active technique ID
- T1564.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1570 Lateral Tool Transfer simulation — Exact active technique ID
- T1570 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.004 Exploits simulation — Exact active technique ID
- T1587.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.001 Malware simulation — Exact active technique ID
- T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.004 Digital Certificates simulation — Exact active technique ID
- T1588.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1673 Virtual Machine Discovery simulation — Exact active technique ID
- T1673 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1675 ESXi Administration Command simulation — Exact active technique ID
- T1675 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1681 Search Threat Vendor Data simulation — Exact active technique ID
- T1681 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686 Disable or Modify System Firewall simulation — Exact active technique ID
- T1686 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1690 Prevent Command History Logging simulation — Exact active technique ID
- T1690 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-name