Cloaked and Covert: Uncovering UNC3886 Espionage Operations
ID: 14a6406b-e3d3-5279-9338-9d89793b5539
STIX ID: report--14a6406b-e3d3-5279-9338-9d89793b5539
Feed Name: Google Cloud Threat Intelligence
Threat Score
**Executive summary:** The report documents UNC3886 activity in which operators deployed MOPSLED and RIFLESPINE backdoors (using ChaCha20 and AES) and leveraged trusted third-party services (GitHub, Google Drive) as covert C2 channels, while also deploying rootkits and backdoored SSH binaries on VMware ESXi/vCenter guest VMs to harvest credentials and enable lateral movement.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.