Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 13:08:46 UTC
Home > List all groups > List all tools > List all groups using tool VIRTUALSHINE
 Tool: VIRTUALSHINE
Names VIRTUALSHINE
Category Malware
Type Backdoor
Description
(Mandiant) VIRTUALSHINE is a simple VMware VMCI sockets-based backdoor that
provides access to a bash shell. VIRTUALSHINE connects to a specified target, which streams
the bash pty.
Information
<https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations>
Last change to this tool card: 26 August 2024
Download this tool card in JSON format
All groups using tool VIRTUALSHINE
Changed Name Country Observed
APT groups
  UNC3886 2021-Early 2025  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=078bf1cc-d8b5-4110-85aa-a5cd0988e21b
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=078bf1cc-d8b5-4110-85aa-a5cd0988e21b
Page 1 of 1