THINCRUST — Malware Profile

THINCRUST is a Python-based backdoor tool that has been used by UNC3886 since at least 2023.

MITRE ATT&CK techniques (5)

• T1059.006 Python
• T1071.001 Web Protocols
• T1140 Deobfuscate/Decode Files or Information
• T1573.001 Symmetric Cryptography
• T1686 Disable or Modify System Firewall

Attributed threat actors

• UNC3886

Read the full analysis on IntelFusions