# UNC3886

> As of 2026-08-30, UNC3886 is a China-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning apt. Also known as Fire Ant.

- **Nation:** China
- **Tracked threats:** 1
- **Categories:** APT
- **Also known as:** Fire Ant
- **As of:** 2026-08-30

## Tracked threats

- [UNC3886 Zero-Day Rootkit Campaign Targeting Singaporean Telecommunications — ORB Network C2, Fortinet/VMware Exploitation, Covert Infrastructure Persistence](https://intel.threadlinqs.com/threat/TL-2026-0221) — CRITICAL

## Related CVEs

7 CVEs referenced by tracked UNC3886 activity.

- [CVE-2025-21590](https://intel.threadlinqs.com/cve/CVE-2025-21590)
- [CVE-2023-34048](https://intel.threadlinqs.com/cve/CVE-2023-34048)
- [CVE-2023-20867](https://intel.threadlinqs.com/cve/CVE-2023-20867)
- [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475)
- [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328)
- [CVE-2022-22948](https://intel.threadlinqs.com/cve/CVE-2022-22948)
- [CVE-2022-1388](https://intel.threadlinqs.com/cve/CVE-2022-1388)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/UNC3886