Quick links
Press Enter to search, Esc to close
Threat group profile
Singapore's cyber agency (CSA) calls UNC3886 a state-sponsored group without naming a state, and MITRE ATT&CK describes it as China-nexus, in entries dated 2025 and 2026.
In short
Singapore's cyber agency (CSA) calls UNC3886 a state-sponsored group without naming a state, and MITRE ATT&CK describes it as China-nexus, in entries dated 2025 and 2026. The group is reported to break into firewalls, routers and virtualization hosts for espionage, and CSA says it targeted all four major Singapore telecom operators.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| UNC3886 | MITRE ATT&CK G1048 (group name) and the Singapore government (CSA, speeches of 18 July 2025 and 9 February 2026)[1, 2, 3, 4] |
| UNC prefix | The Singapore minister said the UNC label stands for uncategorized or unclassified, meaning not formally classified[3] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page created 29 May 2025, last modified 31 July 2026
Describes UNC3886 as a China-nexus cyberespionage group active since at least 2022, targeting defense, technology and telecommunication organizations in the United States and the Asia-Pacific-Japan regions.[1]
MITRE ATT&CK Campaign page created 24 June 2025
Says RedPenguin activity on Junos OS routers was separately attributed to UNC3886, with first activity July 2024 and last March 2025.[10]
Singapore Coordinating Minister for National Security 18 July 2025
Said UNC3886 was attacking Singapore's critical infrastructure. The annex said it had yet to be attributed to a known threat actor group.[3]
Cyber Security Agency of Singapore (CSA) 3 September 2025
Called UNC3886 a state-sponsored APT group, active since at least late 2021, without naming a state.[6]
CSA 3 September 2025
Said UNC3886 targets high-value, strategic targets, including critical infrastructure.[7]
CSA and IMDA 9 February 2026
Said UNC3886 ran a deliberate, targeted and well-planned campaign against Singapore's telecom sector, and that all four major operators were targeted.[2]
Singapore Minister for Digital Development and Information 9 February 2026
Named UNC3886 as the attacker and said it was persistent.[4]
Singapore Ministry of Digital Development and Information 27 February 2026
Told Parliament the campaign targeted the telecom sector, which is critical infrastructure.[5]
CSA 30 June 2026
Called an attempted intrusion by UNC3886 on the four operators one of the most significant incidents of 2025.[8]
Sources differ on when the group started. MITRE says active since at least 2022. CSA says at least late 2021 (3 September 2025), and the annex to the 18 July 2025 speech attributes that date to industry. Sources also differ on a state link. MITRE calls the group China-nexus, CSA calls it state-sponsored, and the annex to the 18 July 2025 speech says it has yet to be attributed to a known threat actor group. No Singapore source opened names a country. Wording of the Singapore telecom event also differs: the 9 February 2026 CSA and IMDA release says the group gained unauthorized access to parts of telco networks, while the 30 June 2026 CSA release calls it an attempted cyber intrusion that was contained.
Each entry is attributed to the group by the sources cited.
CSA says UNC3886 has been active since at least late 2021.[6]
MITRE says UNC3886 has used the THINCRUST backdoor since at least 2023.[18]
MITRE gives July 2024 as first seen for RedPenguin, the campaign on Junos OS routers attributed to UNC3886.[10]
MITRE gives March 2025 as last seen for RedPenguin.[10]
MITRE created its UNC3886 group page.[1]
The Coordinating Minister for National Security said UNC3886 was attacking Singapore's critical infrastructure and that it was serious and ongoing.[3]
CSA described UNC3886 as a state-sponsored APT group.[6]
CSA said critical system owners must report suspected APT incidents within 2 hours. The release does not name the group.[9]
CSA calls the attempted intrusion on four operators one of the most significant incidents of 2025. Exact intrusion dates were not given in the sources opened.[8]
The ministry told Parliament why the government made the attacks public.[5]
CSA said the operation contained the incident with no disruption to services and no evidence of customer data being compromised.[8]
MITRE page for G1048 last modified.[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 13 March 2025 | US CISA | Vulnerability catalog entryAdded CVE-2025-21590 (Juniper Junos OS) to the Known Exploited Vulnerabilities Catalog. The alert does not name UNC3886.[11] |
| 18 July 2025 | Singapore Coordinating Minister for National Security | Public disclosureSaid UNC3886 was attacking critical infrastructure and that CSA and agencies were dealing with it.[3] |
| 3 September 2025 | CSA | Public statementDescribed UNC3886 as a state-sponsored APT group in a press release.[6] |
| 31 October 2025 | CSA | New reporting ruleCybersecurity (Amendment) Act provisions in force: owners must report suspected APT incidents to CSA within 2 hours. The release does not name UNC3886.[9] |
| 9 February 2026 | CSA and IMDA | Operation disclosedDescribed Operation CYBER GUARDIAN, with more than 100 defenders over more than eleven months, closing access points and expanding monitoring at the telcos.[2] |
| 9 February 2026 | Singapore Minister for Digital Development and Information | SpeechThanked the defenders and called for continued vigilance.[2, 4] |
| 27 February 2026 | Singapore Ministry of Digital Development and Information | Parliament answerSaid it does not disclose all cyberattacks but the public should know such threats are real.[5] |
| 30 June 2026 | CSA | Press releaseSaid the operation contained the incident.[8] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Server Software Component: vSphere Installation Bundles T1505.006
MITRE says UNC3886 used malicious installation bundles to install malware and keep access on ESXi hypervisors.[1, 20]
Compromise Host Software Binary T1554
MITRE says UNC3886 trojanized Fortinet firmware and replaced a TACACS+ daemon on Linux.[1, 23]
Traffic Signaling: Port Knocking T1205.001
MITRE says UNC3886 kept access on FortiGate firewalls using ICMP port knocking.[1, 25]
Rootkit T1014
MITRE says UNC3886 used the public rootkits REPTILE and MEDUSA. CSA says rootkits helped it stay hidden in a telecom case.[1, 2, 22]
Indicator Removal: Clear Network Connection History and Configurations T1070.007
MITRE says UNC3886 cleared events with its IP address from several log sources.[1]
VIRTUALPITA Backdoor (MITRE S1217)
MITRE describes a passive backdoor with ESXi and Linux vCenter versions, in use since at least 2022.[1, 12]
VIRTUALPIE Backdoor (MITRE S1218)
MITRE describes a lightweight Python backdoor on ESXi servers, installed through malicious installation bundles.[1, 13]
REPTILE Rootkit (MITRE S1219)
MITRE describes an open-source Linux rootkit that UNC3886 used on targeted virtual machines.[1, 14]
MEDUSA Rootkit (MITRE S1220)
MITRE describes an open-source rootkit that logs credentials.[1, 15]
MOPSLED Backdoor (MITRE S1221)
MITRE describes a modular backdoor used by China-nexus actors including UNC3886 and APT41.[16]
RIFLESPINE Backdoor (MITRE S1222)
MITRE describes a cross-platform backdoor used by the group.[1, 17]
THINCRUST Backdoor (MITRE S1223)
MITRE describes a Python-based backdoor used by UNC3886 since at least 2023.[18]
CASTLETAP Backdoor (MITRE S1224)
MITRE describes an ICMP port knocking backdoor installed on compromised FortiGate firewalls.[1, 19]
TINYSHELL variants Backdoor
MITRE says the RedPenguin campaign included multiple custom versions of the public TINYSHELL backdoor on Juniper routers.[10]
Keep an inventory of firewalls, VPNs and routers, update them regularly, and make sure every exposed service is meant to be public. Singapore's sources describe zero-day flaws, so also plan extra monitoring for devices with no patch yet.
Counters T1190
Periodically check that only approved installation bundles are installed on ESXi hosts.
Counters T1505.006
MITRE says enabling secure boot and the execInstalledOnly feature helps ESXi validate software and block unsigned binaries.
Counters T1505.006
If not needed, restrict who can run Guest Operations on ESXi-hosted virtual machines, and watch for unusual use.
Counters T1675
Make sure binaries on network and security devices are signed by the right developer, and compare firmware to known-good copies.
Counters T1554
MITRE recommends multi-factor authentication across all account types so stolen credentials alone are not enough.
Counters T1078
MITRE says rootkits are hard to prevent, so look for unusual kernel module loads and tampering with system paths that hide processes or files.
Counters T1014
See which firewalls, VPNs, routers and management pages face the internet, the kind of devices the sources say this group goes after.
Follow reporting on this group and check it against the edge devices and virtualization software you run.
Keep exposure findings and threat reports in one place so patching and monitoring tasks are tracked.
MITRE ATT&CK describes it as a China-nexus cyberespionage group active since at least 2022. Singapore's CSA calls it a state-sponsored APT group, active since at least late 2021, and has not named a state.
MITRE says it shows a deep understanding of edge devices and virtualization. Singapore says it exploited zero-day flaws in network devices from Fortinet, VMware and Juniper, and MITRE lists FortiOS, VMware vCenter and Junos OS flaws.
CSA and IMDA said on 9 February 2026 that all four major telecom operators were targeted. In one case it used a zero-day to bypass a firewall and took a small amount of technical data.
CSA and IMDA said there is no evidence to date that sensitive or personal data such as customer records were accessed or taken. CSA said on 30 June 2026 there was no evidence of customer data being compromised.
No Singapore source opened names a country. The annex to the 18 July 2025 speech said the group had yet to be attributed to a known threat actor group. MITRE calls it China-nexus.
Patch or isolate internet-facing firewalls, VPNs and routers, send logs to a separate server, and audit installation bundles on ESXi hosts.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.