Procedure examples

UNC3886 has used MiniDump to dump process memory and search for cleartext credentials.

UNC3886 has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.

UNC3886 has established remote SSH access to targeted ESXi hosts.

UNC3886 has replaced atomic indicators mentioned in threat intelligence publications, sometimes as quickly as under a week after release.

UNC3886 has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilitates communication between FortiManager and the FortiGate firewall.

UNC3886 has attempted to bypass digital signature verification checks at startup by adding a command to the startup config `/etc/init.d/localnet` within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.

UNC3886 has placed a bash installation script into `/etc/rc.local.d/` to establish persistence.

UNC3886 has used the LOOKOVER sniffer to sniff TACACS+ authentication packets.

UNC3886 has run scripts to list all running processes on a guest VM from an ESXi host.

UNC3886 has used a PowerShell script to search memory dumps for credentials.

UNC3886 has executed Windows commands on guest virtual machines through `vmtoolsd.exe`.

UNC3886 has used a bash script to install malicious vSphere Installation Bundles (VIBs).

UNC3886 has used Python scripts to enumerate ESXi hosts and guest VMs.

UNC3886 has used the esxcli command line utility to modify firewall rules, install malware, and for artifact removal.

UNC3886 has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

UNC3886 has used the the esxcli command line to remove files created by malicious vSphere Installation Bundles from disk.

UNC3886 has used scripts to timestomp ESXi hosts prior to installing malicious vSphere Installation Bundles (VIBs).

UNC3886 has cleared specific events that contained the threat actor’s IP address from multiple log sources.

UNC3886 has staged captured credentials in `var/log/ldapd<unique_keyword>.2.gz`.

UNC3886 has used tools to hijack valid SSH accounts.

UNC3886 has harvested and used vCenter Server service accounts.

UNC3886 has used `vmtoolsd.exe` to enumerate files on guest machines.

UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.

UNC3886 has used installation scripts to collect the system time on targeted ESXi hosts.

UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.

UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.

UNC3886 has used the TABLEFLIP traffic redirection utility to listen for specialized command packets on compromised FortiManager devices.

UNC3886 maintained persistence on FortiGate Firewalls through ICMP port knocking.

UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.

UNC3886 has used rundll32.exe to execute MiniDump for dumping LSASS process memory.

UNC3886 has used vSphere Installation Bundles (VIBs) to install malware and establish persistence across ESXi hypervisors.

UNC3886 has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the `acceptance-level` set to `partner` which allowed for privilege escalation.

UNC3886 has trojanized Fortinet firmware and replaced the legitimate `/usr/bin/tac_plus` TACACS+ daemon for Linux with a malicious version containing credential logging functionality.

UNC3886 has targeted KeyPass password database files for credential access.

UNC3886 has used Gzip and the Windows command `makecab` to compress files and stolen credentials from victim systems.

UNC3886 has XOR encrypted and Gzip compressed captured credentials.

UNC3886 modified the startup file `/etc/init.d/localnet` to execute the line `nohup /bin/support &` so the script would run when the system was rebooted.

UNC3886 has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.

UNC3886 has deployed custom malware families on Fortinet and VMware systems.

UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA.

UNC3886 has deployed malware using the victim's legitimate TLS certificate obtained from a compromised FortiGate device.

UNC3886 has used scripts to enumerate ESXi hypervisors and their guest VMs.

UNC3886 used `vmtoolsd.exe` to run commands on guest virtual machines from a compromised ESXi host.

UNC3886 has replaced indicators mentioned in open-source threat intelligence publications at times under a week after their release.

UNC3886 has disabled OpenSSL digital signature verification of system files through corruption of boot files.

UNC3886 has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.

UNC3886 has tampered with and disabled logging services on targeted systems.