{"id":59052,"date":"2025-07-28T00:00:00","date_gmt":"2025-07-28T00:00:00","guid":{"rendered":"urn:uuid:76709681-f25c-5167-b621-326c03dcbcf2"},"modified":"2025-07-28T00:00:00","modified_gmt":"2025-07-28T00:00:00","slug":"revisiting-unc3886-tactics-to-defend-against-present-risk","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/revisiting-unc3886-tactics-to-defend-against-present-risk\/","title":{"rendered":"Revisiting UNC3886 Tactics to Defend Against Present Risk"},"content":{"rendered":"

<\/p>\n

<\/div>\n

On July 18, Singapore\u2019s Coordinating Minister for National Security K. Shanmugam revealed that the country was facing a highly sophisticated threat actor<\/a> targeting critical infrastructure\u2014UNC3886. First reported<\/a> in 2022, this advanced persistent threat (APT) group has been targeting essential services in Singapore, posing a severe risk to their national security.<\/p>\n

In this entry, we draw on observations and the tactics, techniques, and procedures (TTPs) from previously recorded UNC3886 attacks. Our aim is to get a good understanding of this threat group and enhance overall defensive posture against similar tactics.<\/p>\n

An overview of UNC3886<\/span><\/h2>\n

UNC3886 is a cyber espionage group whose targets include the US, Europe, and Singapore, where it currently represents a significant threat. Known for its persistent attack methods, the group homes in on critical sectors such as government, telecommunications, technology, defense, energy, and utilities. While first reported in 2022, there have been evidence of its activity dating back to late 2021<\/a>.<\/p>\n

The Cyber Security Agency (CSA) of Singapore has been actively investigating UNC3886’s activities and monitoring all critical service sectors. The group’s activities have been detected in parts of Singapore’s critical information infrastructure that power essential services, highlighting the severe threat they pose to national security. Although the specific sectors affected have not been disclosed, the agency has emphasized the need to preserve operational security by not disclosing further information at this stage.<\/p>\n

Tactics, Techniques and Procedures<\/span><\/h2>\n

UNC3886 operates using advanced techniques and primarily targets network devices, virtualization systems (e.g. VMware vCenter\/ESXi, Fortinet FortiOS, and Juniper Junos OS), and critical information infrastructure. The group is also known for using zero-day exploits and deploying custom open-source malware specifically developed to evade detection and maintain persistence within the target networks. Additionally, UNC3886 leverages tools already present on the victim’s system to further evade detection.<\/p>\n

Even when detected and removed, the group is persistent and often attempts re-entry into the network. The group’s attack chain involves several advanced techniques including:<\/p>\n