# UNC3886 Zero-Day Rootkit Campaign Targeting Singaporean Telecommunications — ORB Network C2, Fortinet/VMware Exploitation, Covert Infrastructure Persistence

> China-nexus APT group UNC3886 exploited zero-day vulnerabilities in Fortinet FortiOS and VMware vCenter/ESXi to deploy REPTILE and MEDUSA rootkits against all four major Singaporean telecom operators (M1, SIMBA Telecom, Singtel, StarHub), leveraging Operational Relay Box (ORB) network infrastructure for covert C2 communications and stealing communication infrastructure technical data in a multi-year espionage campaign that triggered Singapore's largest-ever multi-agency cyber response, Operation CYBER GUARDIAN.

- **Published:** 2026-03-13T12:00:00Z
- **Last reviewed:** 2026-08-30T17:29:58.572Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0221
- **ID:** TL-2026-0221
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** APT
- **Status:** MONITORING
- **Actor:** UNC3886 (China)
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-41328, CVE-2022-42475, CVE-2023-34048, CVE-2023-20867, CVE-2022-22948, CVE-2025-21590, CVE-2022-1388

## Description

UNC3886 is a highly sophisticated China-nexus cyber espionage group active since at least 2022, known for exploiting zero-day vulnerabilities in edge devices and virtualization platforms to establish stealthy, long-term persistent access to high-value targets. In this campaign, UNC3886 targeted Singapore's critical telecommunications infrastructure, compromising all four major operators — M1, SIMBA Telecom, Singtel, and StarHub.

The initial intrusion vector involved exploitation of a zero-day vulnerability to bypass perimeter firewalls, consistent with UNC3886's documented use of CVE-2022-42475 (FortiOS SSL VPN heap buffer overflow enabling unauthenticated remote code execution) and CVE-2022-41328 (FortiOS path traversal via CLI commands). Once inside the network perimeter, the threat actor exploited VMware vCenter vulnerabilities including CVE-2023-34048 (DCERPC out-of-bounds write for unauthenticated RCE) and CVE-2023-20867 (VMware Tools authentication bypass) to pivot through virtualization infrastructure.

For persistence and defense evasion, UNC3886 deployed the REPTILE kernel-mode Linux rootkit, which provides stealthy process, file, and network connection hiding capabilities through flag manipulation, as well as reverse shell access via port knocking. The MEDUSA rootkit, utilizing LD_PRELOAD dynamic linker hijacking, was deployed for credential logging from PAM authentication hooks and covert command execution. Both rootkits were installed on guest virtual machines to maintain access and evade endpoint detection.

The campaign's command-and-control infrastructure leveraged Operational Relay Box (ORB) networks — a sophisticated proxy mesh that routes attacker traffic through compromised devices and rented infrastructure across multiple autonomous systems. Team Cymru identified up to 12 unique ORB-tagged IPs communicating with the four victim ISPs within a 90-day window, with 44 total ORB nodes located within Singapore. In a 30-day observation period, 42 unique ORB IPs communicated with victim ISPs, while 62 unique victim IPs communicated back with ORBs, indicating deep network penetration.

Additional malware deployed includes TinyShell (a Python-based RAT providing HTTP/HTTPS command execution), CASTLETAP (a passive FortiGate firewall backdoor disguised as /bin/fgfm that activates on specially crafted ICMP magic packets), MOPSLED (a modular shellcode backdoor using ChaCha20 encryption with HTTP/TCP C2), RIFLESPINE (a cross-platform backdoor leveraging Google Drive for file transfers with AES encryption), and VIRTUALPITA/VIRTUALPIE (vSphere Installation Bundle backdoors for ESXi hypervisor persistence). LOOKOVER, a C-based sniffer, was used to intercept TACACS+ authentication credentials.

The Singapore Cyber Security Agency (CSA) first detected the intrusion on July 18, 2025, leading to Operation CYBER GUARDIAN — described as Singapore's largest-ever multi-agency cyber operation. The CSA confirmed that while the threat actor gained unauthorized access to parts of the telecom networks including critical systems, there was no evidence of personal data exfiltration or internet availability disruption. The campaign's primary objective was theft of communication infrastructure technical data, consistent with UNC3886's espionage mandate.

This campaign shares tooling and targeting overlaps with the Fire Ant cluster disclosed by Sygnia in July 2025, which similarly targeted VMware ESXi, vCenter environments, and network appliances. UNC3886 was also linked to Campaign RedPenguin (C0056, July 2024 - March 2025) targeting Juniper Networks routers with custom TINYSHELL-based backdoors, exploiting CVE-2025-21590 (Junos OS kernel privilege escalation).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1098 Account Manipulation
- T1037 Boot or Logon Initialization Scripts
- T1543 Create or Modify System Process
- T1505 Server Software Component
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1564 Hide Artifacts
- T1056 Input Capture
- T1212 Exploitation for Credential Access
- T1003 OS Credential Dumping
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1673 Virtual Machine Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1040 Network Sniffing
- T1557 Adversary-in-the-Middle
- T1074 Data Staged
- T1573 Encrypted Channel
- T1090 Proxy
- T1095 Non-Application Layer Protocol
- T1205 Traffic Signaling
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1104 Multi-Stage Channels
- T1041 Exfiltration Over C2 Channel
- T1003.001 OS Credential Dumping
- T1649 Steal or Forge Authentication Certificates
- T1005 Data from Local System
- T1210 Exploitation of Remote Services

## Sources

- [February 2026 APT Group Trends Report — ASEC (AhnLab)](https://asec.ahnlab.com/en/92906/)
- [CSA Singapore — Largest Multi-Agency Cyber Operation Against UNC3886](https://www.csa.gov.sg/news-events/press-releases/largest-multi-agency-cyber-operation-mounted-to-counter-threat-posed-by-advanced-persistent-threat--apt--actor-unc3886-to-singapore-s-telecommunications-sector/)
- [China-Linked UNC3886 Targets Singapore Telecom Sector — The Hacker News](https://thehackernews.com/2026/02/china-linked-unc3886-targets-singapore.html)
- [Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms — SecurityWeek](https://www.securityweek.com/singapore-rootkits-zero-day-used-in-chinese-attack-on-major-telecom-firms/)
- [Tracking ORBs on Singapore Telecommunications Networks — Team Cymru](https://www.team-cymru.com/post/tracking-orbs-on-singapores-telecommunications-networks)
- [UNC3886 (G1048) — MITRE ATT&CK](https://attack.mitre.org/groups/G1048/)
- [Cloaked and Covert: Uncovering UNC3886 Espionage Operations — Google Cloud / Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations)
- [Fortinet Zero-Day and Custom Malware in Espionage Operation — Google Cloud / Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/fortinet-malware-ecosystem)
- [Chinese VMware Exploitation Since 2021 (CVE-2023-34048) — Google Cloud / Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021/)
- [Revisiting UNC3886 Tactics to Defend Against Present Risk — Trend Micro](https://www.trendmicro.com/en_us/research/25/g/revisiting-unc3886-tactics-to-defend-against-present-risk.html)
- [Singapore Mounts Largest Ever Cyber Operation to Oust APT Actor — Computer Weekly](https://www.computerweekly.com/news/366638973/Singapore-mounts-largest-ever-cyber-operation-to-oust-APT-actor)
- [Unmasking UNC3886: A Sophisticated Cyber Espionage Group — TXOne Networks](https://www.txone.com/blog/unmasking-unc3886/)
- [UNC3886 Threat Actor Profile — FortiGuard](https://www.fortiguard.com/threat-actor/6164/unc3886)
- [Singapore Says China-Backed Hackers Targeted Largest Phone Companies — TechCrunch](https://techcrunch.com/2026/02/10/singapore-china-backed-hackers-targeted-largest-phone-companies-salt-typhoon/)
- [OT-ISAC Warns Singapore Critical Infrastructure of UNC3886 — Industrial Cyber](https://industrialcyber.co/critical-infrastructure/ot-isac-warns-singapore-critical-infrastructure-of-unc3886-exploiting-zero-days-in-fortinet-vmware-juniper-systems/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0221