StarHub

Summary

Singapore’s Cyber Security Agency said that the telecom operators Singtel, StarHub, M1 and Simba Telecom were targeted by the espionage group UNC3886, which gained access to parts of their networks but did not disrupt services or obtain personal data, only exfiltrating a small amount of technical information described as network‑related. Mandiant characterizes UNC3886 as a China‑nexus group that has previously attacked defense, technology and telecommunications firms in the United States and Asia, a claim denied by Beijing. The companies noted they face a range of threats and employ defense‑in‑depth measures, working with agencies such as the Cyber Security Agency, IMDA and GovTech to block the intrusion points, improve monitoring and conduct joint threat hunting and penetration testing to strengthen resilience.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In February 2026, Singapore's Cyber Security Agency disclosed that in the previous year (2025) the cyber espionage group UNC3886 targeted Singtel, StarHub, M1, and Simba Telecom. The hackers penetrated some parts of the telecom systems and exfiltrated a small amount of technical data believed to be primarily network-related. They did not disrupt services or access personal data. The group used a zero-day exploit to bypass the telcos' perimeter firewall and employed rootkits to maintain persistent access, cover their tracks, and evade detection. The attack was first disclosed publicly in July 2025 when the government said it was responding to cyberattacks targeting high-value strategic assets.

The response was coordinated through Operation Cyber Guardian, a group of 100 cyber defenders drawn from six government agencies: the Cyber Security Agency, the Infocomm Media Development Authority, the Centre for Strategic Infocomm Technologies, the Digital and Intelligence Service of the Singapore Armed Forces, the Internal Security Department, and GovTech. The Infocomm Media Development Authority announced that remediation measures had been implemented, UNC3886’s access points blocked, and monitoring capabilities increased for the targeted telecommunications companies. The Infocomm Media Development Authority and the Cyber Security Agency worked closely with the telecom firms to strengthen cybersecurity defenses, improve detection, and deploy active monitoring systems. The telecom companies themselves carried out joint threat hunting, penetration testing, and capability enhancements. The Cyber Security Agency said it would introduce initiatives to gradually improve capabilities across Singapore's cyber ecosystem to enable more effective and timely responses to cyber threats.

Mandiant has described UNC3886 as a China-nexus espionage group that has attacked defense, technology, and telecommunications organizations in the United States and Asia. Singapore's Coordinating Minister for National Security, K. Shanmugam, had previously identified UNC3886 as a highly sophisticated threat actor attacking the city's critical infrastructure, though he withheld details citing security interests. Officials contrasted the UNC3886 incident with earlier state-sponsored breaches, such as the 2014 intrusion into the Ministry of Foreign Affairs' IT system and the 2018 SingHealth data theft that exposed 1.5 million records. They noted that UNC3886 poses a more serious threat because it targets critical systems that provide essential services to the public. Officials warned that, had the attackers progressed further, the intrusion could have allowed them to cut off telecom or internet services, thereby threatening national security and the economy.

Sources

Sources available to members: 3 sources.