UNC3886: Global Critical Infrastructure Under Attack

UNC3886 represents a formidable and persistent cyber espionage threat, currently active and impacting critical information infrastructure (CII) worldwide.

Threat actor UNC3886 distinguishes itself through highly sophisticated, cautious, and evasive operational methodologies. Its primary objective is long-term intelligence gathering and strategic spying, focusing on high-value targets across government, defense, technology, and telecommunications sectors in the US and Asia.

As of July 2025, UNC3886 is actively engaged in attacks against Singapore’s critical infrastructure, underscoring the immediate and severe nature of its threat to national security and essential services.