UNC3886
Named by 3 kept items in this workspace.
Search every workspace for UNC3886. It matches the name as written, so it can find other things that share it.
The items that name it 3
Suspected China-nexus actor that targeted FortiGate firewalls using CVE-2022-41328, compromised FortiManager to push script deployments delivering the CASTLETAP backdoor, then pivoted to VMware ESXi hypervisors
Threat actor observed by Mandiant using the custom Reptile launcher throughout their espionage operations.
Espionage threat actor discussed in cited Mandiant blog post 'Cloaked and Covert: Uncovering UNC3886 Espionage Operations', reportedly using REPTILE rootkit among other tooling
All threat actors in this workspace.