Mandiant report that UNC3886 actor is targeting firewalls, IOT devices and VPNs The cyber security company Mandiant has published a blog detailing ongoing campaigns by a Chinese espionage threat actor it calls UNC3886. The actor takes advantage of technologies that don’t support endpoint detection response, such as firewalls, IoT devices, hypervisors and VPN technologies. The actor has exploited zero-day vulnerabilities and then deployed custom malware as an attack vector before traversing the target environment and gaining persistence. The report that concludes that communication and collaboration across organisations is essential for both vendors and investigators to help mitigate the activity.