Singapore Telecommunications Limited

Summary

Singapore Telecommunications Limited, together with StarHub, M1 and Simba Telecom, was targeted by the cyber espionage group UNC3886, which gained access to portions of their telecom networks without disrupting services or obtaining personal data. The attackers exfiltrated a limited amount of technical, network‑related information to support their operational objectives. Mandiant has identified UNC3886 as a China‑linked espionage group that has previously struck defense, technology and telecommunications entities in the United States and Asia. Singapore authorities stated that this was the first disclosure of the specific infrastructure targeted by the group and noted that the incident prompted a coordinated multi‑agency response involving the Cyber Security Agency, IMDA, CSIT, the Digital and Intelligence Service, the Internal Security Department and GovTech. The telecom companies confirmed they employ defense‑in‑depth measures, conduct prompt remediation and collaborate with government and industry partners to enhance network resilience.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Singapore’s Cyber Security Agency announced on Monday February 9 2026 that the four national telecom operators—Singtel, StarHub, M1 and Simba Telecom—had been targeted by the cyber espionage group UNC3886 in attacks that occurred during the previous year. The agency said the hackers succeeded in penetrating and gaining access to certain parts of the telecom systems but were unable to disrupt services or obtain any personal customer data. According to the statement, the attackers managed to exfiltrate a small amount of technical information that is believed to be primarily network‑related data intended to support the threat actors’ operational objectives. Google‑owned Mandiant characterized UNC3886 as a China‑nexus espionage group that has previously directed operations against defence, technology and telecommunications organisations in the United States and Asia. The Chinese Embassy in Singapore did not provide a comment when approached for a response. The disclosure marked the first time the Singapore government publicly identified the type of infrastructure that UNC3886 had sought to compromise, following an earlier July 2025 announcement that the state was responding to cyberattacks from the same group aimed at high‑value strategic assets. In a joint statement the telecom companies noted that they routinely face threats such as distributed denial‑of‑service attacks, malware, phishing and more sophisticated advanced persistent threats, and that they employ defence‑in‑depth strategies, conduct prompt remediation when issues are detected and collaborate with government agencies and industry experts to improve security and resilience.

The attackers were able to reach a few critical systems in at least one instance but did not advance far enough to interrupt service delivery, and investigations have found no evidence that sensitive customer information was accessed or stolen. Josephine Teo, Singapore’s Minister for Digital Development and Information, emphasized that UNC3886 poses a more serious threat than earlier incidents because it targets critical systems that underpin essential public services, noting that a successful intrusion could eventually allow the disruption of telecom or internet connectivity. She referenced past state‑sponsored cyber events in Singapore, including a 2014 intrusion into the Ministry of Foreign Affairs’ IT system that attempted to steal sensitive data and a 2018 breach of SingHealth’s systems that resulted in the exfiltration of more than 1.5 million records, including those of former Prime Minister Lee Hsien Loong. The IMDA reported that UNC3886 employed a zero‑day exploit to bypass the telecoms’ perimeter firewalls and used rootkits and other advanced tools to maintain persistent access, conceal activity and evade detection while extracting the limited technical data.

In response, Singapore launched Operation Cyber Guardian, a coordinated effort involving approximately 100 cyber defenders drawn from six government agencies: the Cyber Security Agency of Singapore, the Infocomm Media Development Authority, the Centre for Strategic Infocomm Technologies, the Digital and Intelligence Service of the Singapore Armed Forces, the Internal Security Department and GovTech. Teo described the operation as the largest coordinated cyber response undertaken by Singapore to date. The IMDA announced that defenders had implemented remediation measures, blocked the identified access points used by UNC3886 and increased monitoring capabilities for the affected telecommunications companies. The IMDA, together with the CSA, is working closely with the telecom operators to strengthen cybersecurity defences, improve detection mechanisms and deploy active monitoring systems intended to guard against further intrusion attempts. Additionally, the telecom companies have undertaken joint threat hunting exercises, conducted penetration testing and enhanced their internal security capabilities under the IMDA’s guidance. The CSA has indicated that it will introduce progressive initiatives to uplift capabilities across Singapore’s broader cyber ecosystem, aiming to enable more timely and effective responses to emerging threats and to reinforce national cyber defences. While these actions have contributed to containing the UNC3886 campaign thus far, authorities acknowledge that future attempts to compromise telecom infrastructure remain possible given the sector’s strategic importance to the digital economy and national security.

Sources

Sources available to members: 3 sources.