Threat Actor
UNC3886
- First Reported
- Jul 22, 2026
- Latest Reported
- Oct 6, 2026
Reported Context (2)
- Identified as a China-nexus cluster previously attributed use of TinyShell and as having targeted telecom networks and edge devices; the article gives Fire Ant as an alias. Linux Backdoors Masquerade as Email Security Tools on South Korean and Taiwanese Appliances
- Reportedly compromised FortiManager and used script deployment to push backdoors to FortiGate devices; the article also describes its use of CASTLETAP and subsequent pivoting to ESXi hypervisors. Threat-Hunting Guide Shows How to Detect Attacks on FortiGate Appliances
CVE (7)
Malware (4)
Threat Actors (11)
MITRE ATT&CK (12)
Vendors (4)
Products (9)
Tools (6)
Industries (1)
Countries (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.