UNC3886 Backdoored SSH Credential Log File Creation

Elpy Project@Elpy

•updated Mar 28, 2026•1•0•117

Detects the creation of specific log files (`ldapd*.1.gz`, `ldapd*.2.gz`) in the `/var/log/` directory. This behavior is indicative of the UNC3886 threat actor utilizing backdoored SSH clients and daemons to harvest and store XOR-encrypted credentials.