UNC3886
Attribution profile
- Type
- Spy
- Location
- China
- Known incidents
- 8 incidents
- Sources
- 115 sources
- First seen
- 2025-07-01
- Last seen
- 2026-02-01
- Updated
- 2026-10-13 05:50
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
UNC3886, also known as Daggerfly, is a China-linked cyber‑espionage group that has targeted telecommunications providers in Singapore as well as defense, technology and telecommunications entities in the United States and Asia. The group employs zero‑day exploits, rootkits and advanced persistence mechanisms to gain long‑term access to backbone infrastructure, enabling it to monitor authentication, siphon technical/network data and maintain upstream surveillance without disrupting services. Notable operations include the 2025‑07‑01 intrusion into Singapore’s four major telcos (Singtel, StarHub, M1 and Simba Telecom) and earlier reported compromises of defense and technology sectors in the US and Asia.
Incidents
Attributed incidents are available to members.
8 incidentsSources
Sources available to members: 115 sources.