Fire Ant
MITRE G1049Also known as UNC3886
Reports
8
First seen
Aug 31, 2026
Last seen
Oct 2, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
United States ×1
Top ATT&CK techniques
T1041 Exfiltration Over C2 Channel ×6T1190 Exploit Public-Facing Application ×5T1003 OS Credential Dumping ×4T1547 Boot or Logon Autostart Execution ×4T1021 Remote Services ×3T1486 Data Encrypted for Impact ×3T1005 Data from Local System ×3T1566 Phishing ×3T1078 Valid Accounts ×2T1204 User Execution ×2T1021.002 Remote Services: SMB/Windows Admin Shares ×2T1543 Create or Modify System Process ×2
Indicators
cve ×93hash_sha1 ×6filename ×2domain ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2026-19490 (exploited)CVE-2025-49113 (exploited)CVE-2026-0768 (exploited)CVE-2026-20079 (exploited)CVE-2026-20212CVE-2026-20274CVE-2026-20275CVE-2026-20279CVE-2026-20280CVE-2026-20281CVE-2026-20354CVE-2026-20355CVE-2026-33824 (exploited)CVE-2026-58231 (exploited)CVE-2026-60004 (exploited)CVE-2026-64849 (exploited)CVE-2026-65400 (exploited)CVE-2026-65660 (exploited)CVE-2026-66747 (exploited)CVE-2026-68820 (exploited)
Recent reports
High