The Threat CodexJul 29, 2025
Revisiting UNC3886 Tactics to Defend Against Present Risk
#UNC3886 #Reptile #MedusaRootkit #MopSled
https://www.trendmicro.com/en_us/research/25/g/revisiting-unc3886-tactics-to-defend-against-present-risk.html
Revisiting UNC3886 Tactics to Defend Against Present Risk

We examine the past tactics used by UNC3886 to gain insights for insights on how to best strengthen defenses against the continued and emerging threats of this APT group.

Trend Micro
The Threat CodexJul 25, 2025
Fire Ant: A Deep-Dive into Hypervisor-Level Espionage
#FireAnt #CVE_2023_34048 #CVE_2022_1388 #MedusaRootkit
https://www.sygnia.co/blog/fire-ant-a-deep-dive-into-hypervisor-level-espionage/
Fire Ant: Hypervisor-Level Espionage Targeting VMware ESXi & vCenter | Sygnia

Discover Sygnia’s investigation into Fire Ant, an advanced cyber-espionage campaign breaching VMware ESXi, vCenter, and network appliances. Learn how the attackers bypassed traditional defenses with hypervisor-level persistence and stealth.

Sygnia