UNC3886 Uses Fortinet, VMware 0-Days and Stealth Tactics in Long-Term Spying

UNC3886, a China-nexus cyber espionage actor, has been observed exploiting multiple zero-day vulnerabilities in Fortinet and VMware products to establish persistent access across victims in North America, Southeast Asia, Oceania and other regions; the actor uses VM-targeted rootkits (Reptile, Medusa), backdoors (MOPSLED, RIFLESPINE), backdoored SSH/TACACS tools for credential harvesting, and cloud services (GitHub, Google Drive) as C2 channels, prompting organizations to follow Fortinet and VMware advisories to mitigate risk.