UNC3886
IntrusionSet · ATTACK:enterprise:G1048
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1048",
"title": "UNC3886",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1048",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--461b8e25-8f4a-4ea2-a4a8-e39df7ce6630",
"external_id": "G1048",
"domain": "enterprise",
"created": "2025-05-29T20:48:42.051Z",
"modified": "2026-07-31T18:47:52.855Z",
"version": "1.0",
"aliases": [
"UNC3886"
],
"tactics": [
],
"source_references": [
{
"source_name": "Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"
},
{
"source_name": "Mandiant Fortinet Zero Day",
"url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
}
]
}Explicit source assertions (58)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0057843b-ebe3-43f9-9ae0-90c8bdc802fc
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1681
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--007e0ded-c7c8-484f-af74-d4182b88c8c5
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02456435-caff-435a-909f-9b27c8cf35d3
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1059.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--071cddbe-70f6-4577-b73e-cc7a99d6ae09
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c75b350-2996-47f8-9e01-38b7cf53481c
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d122084-f2fa-4247-a913-068a3250c89b
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1218
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21b39f90-0ebe-4d28-a112-553b7daf8e8d
Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--221a785c-45cc-42d7-9831-268a2d6019e3
Google Cloud Mandiant UNC3886 2024 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1224
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e146af-eca7-4801-9b8e-6af031dd7963
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1223
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bad6d78-dfb0-4f6c-af0e-97f047187ae6
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c880ffc-9fbb-4d19-bfff-72ad6320f003
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1673
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d1a9941-df94-4e1f-9132-80b052bcb1fc
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1564.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d2dd387-7be4-4636-8889-94ccf10cdfc2
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f45f81a-c4cf-4091-ac64-caaf5e925861
Mandiant Fortinet Zero DayATTACK:enterprise:C0056 → attributed-to → ATTACK:enterprise:G1048
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cde6cab-a70e-45d3-b1e5-a7a6ba08241e
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1212
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4587a583-506d-4096-84d8-bf953af2ca2b
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1675
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47736f23-469c-40a6-b287-8a6a39eca799
Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49ef7dce-c472-4a9e-a0a7-1a9c35991ef4
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b6c887c-5fae-49d2-acf2-5922bab839dc
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1070.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e8250fb-25d8-4a9a-ba49-40d7c4090c64
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56c83dcc-1e3c-4816-8178-570232bbab39
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--650b58f8-3968-420f-94c2-6173fbc600c6
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dde5532-a13a-4b47-b063-1a95ad25820b
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1690
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ae61737-1c5d-4323-b54b-77f3d008a2cc
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1560.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88ad5157-7e81-4189-9899-a5e436713261
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b7be75b-ae8e-46c5-b59d-cb278f76f57a
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d46d48e-cd93-4e9f-a28c-c09e3a072194
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--907b4dbb-83e2-4357-aee8-9bcabc2feb96
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96e32457-57ee-49cc-924d-4211cbb57291
Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--970ed37e-d468-40cf-a6c4-b6dfce5a1c4b
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b3abb66-be78-41eb-8442-23451108fd37
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c3b5b84-655b-452e-93f1-d0fbbd91baaa
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1587.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d4acc40-51a4-4d42-acdb-1e0e911bcd59
Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1505.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9df873c3-9820-4b94-adae-b6a5cd271dce
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f7800b9-9152-4f4a-a7f7-ad5823b710c3
Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fa7c256-046d-4c4b-8549-1187320002a7
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0595621-4352-48e6-8ac2-6a7b87b254ac
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4283f85-04af-4174-85be-86ea6ed61cd1
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1588.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4bc3995-bd65-4a40-b7fc-088dcdddde0a
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a50e8815-a47b-4a6d-9e51-b5fdba686c2c
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab429228-9528-49c6-a986-7999199ab7f7
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1037
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae7cff1e-cb46-45f5-8d96-e2448f64cfe2
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3c11e91-229d-4624-bf0c-2178c780c5cd
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b58f6de7-94a3-4d01-8bb6-491bf125095b
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b707b5ce-7bc7-4373-bc1e-dad8cb81e74c
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be91925a-6d23-4d1d-a2e6-862ff823e010
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3052152-0382-4944-9e77-d63e94fff700
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1205.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8312f85-9a7f-425f-9c6d-d0d50cf6f5eb
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca3b64e6-7422-48ce-b9c0-eff9d4ad2635
Google Cloud Mandiant UNC3886 2024 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd9ce33c-994d-4378-96b3-10cce4bdf8fa
Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf27fd72-fb7a-453e-a201-e3ec2de130e0
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1c4e56d-8738-4f8b-ac06-5db3877abac8
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1220
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d229459e-05f6-497b-85c3-68b05a47178c
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1059.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2b8fa7f-7bd5-4bf5-b5e0-82ec42f40283
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d74d9573-af4b-4984-ba5c-2cbd2b010fb2
Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:S1222
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8f11616-88cf-464f-93aa-f460d46b0f94
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4e63423-1500-493e-b6ae-fefc0095b767
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Mandiant Fortinet Zero DayATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f96e840a-b41b-4238-a664-db6fa5bf0c22
Google Cloud Mandiant UNC3886 2024