CyberSecurityBoardThreat Intel · CVEs · Products
Cyber Companies

Mandiant: Documentation of UNC3886’s VMCI Use

June 25, 2026

Mandiant is a cybersecurity company that documented UNC3886's use of VMware VMCI sockets for persistence between ESXi hosts and guest VMs, a technique also seen in SLEEPWALKER.