UNC3886
Reports
3
First seen
Feb 11, 2026
Last seen
Aug 31, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1562.001 Impair Defenses: Disable or Modify Tools ×2T1070.001 Indicator Removal: Clear Windows Event Logs ×2T1041 Exfiltration Over C2 Channel ×2T1543 Create or Modify System Process ×2T1547.004 Boot or Logon Autostart Execution: Systemd ×1T1572 Protocol Tunneling ×1T1003 OS Credential Dumping ×1T1021.004 Remote Services: SSH ×1T1078 Valid Accounts ×1T1018 Remote System Discovery ×1T1190 Exploit Public-Facing Application ×1T1555 Credentials from Password Stores ×1
Indicators
hash_sha1 ×6cve ×2domain ×1
Indicator values are available on Pro and via the API.