Google Cloud Mandiant UNC3886 2024

UNC3886 has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.

REPTILE has the ability to hook kernel functions and modify functions data to achieve rootkit functionality such as hiding processes and network connections.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.

MEDUSA is a rootkit with command execution and credential logging capabilities.

MOPSLED can encrypt configuration files with a custom ChaCha20 algorithm.

MEDUSA can XOR encrypt configuration strings.

UNC3886 has used the LOOKOVER sniffer to sniff TACACS+ authentication packets.

REPTILE can deploy components automatically with shell scripts.

RIFLESPINE can execute commands with `/bin/sh`.

VIRTUALPIE is a Python-based backdoor malware.

MOPSLED can communicate to C2 nodes over HTTP.

RIFLESPINE can use HTTP `GET` and `PUT` to upload and download files.

UNC3886 has staged captured credentials in `var/log/ldapd<unique_keyword>.2.gz`.

RIFLESPINE can stage the output from executed C2 commands to a temporary file.

UNC3886 has used tools to hijack valid SSH accounts.

RIFLESPINE can collect system information after installation on infected systems.

MOPSLED can use a custom binary protocol over TCP for C2 communication.

REPTILE can communicate using TLS over raw TCP.

UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.

MOPSLED can use third-party web services such as GitHub and Google Drive for C2.

MOPSLED has the ability to retrieve a C2 address from a dead drop URL.

RIFLESPINE can retrieve C2 commands from an encrypted file on Google Drive then upload the results of command execution back to Google Drive.

RIFLESPINE can download and execute files.

The REPTILE launcher component can decrypt kernel module code from a file and load it into memory.

RIFLESPINE can deobfuscate encrypted files prior to execution on targeted hosts.

MOPSLED can decrypt obfuscated configuration files.

UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.

UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.

The REPTILE reverse shell component can listen for a specialized packet in TCP, UDP, or ICMP for activation.

REPTILE has the ability to control compromised endpoints via port knocking.

UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.

RIFLESPINE can create a systemd service file for execution.

The REPTILE launcher can daemonize a process.

REPTILE has used udev for persistence.

The REPTILE rootkit is implemented as a loadable kernel module (LKM).

UNC3886 has trojanized Fortinet firmware and replaced the legitimate `/usr/bin/tac_plus` TACACS+ daemon for Linux with a malicious version containing credential logging functionality.

UNC3886 has used Gzip and the Windows command `makecab` to compress files and stolen credentials from victim systems.

UNC3886 has XOR encrypted and Gzip compressed captured credentials.

MEDUSA can be configured to capture SSH credentials via SSH hijacking.

REPTILE has the ability to communicate with the kernel-mode component to hide files.

RIFLESPINE can upload results from executed C2 commands to cloud storage.

VIRTUALPIE can use a custom RC4 encrypted protocol for C2 communications.

RIFLESPINE can use the AES algorithm to encrypt C2 data.

REPTILE can use TLS over raw TCP for secure C2.

MEDUSA can execute code through dynamic linker hijacking of the `LD_PRELOAD` library.

UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA.

UNC3886 has deployed malware using the victim's legitimate TLS certificate obtained from a compromised FortiGate device.

UNC3886 used `vmtoolsd.exe` to run commands on guest virtual machines from a compromised ESXi host.