Loading story…
Singapore launched its largest coordinated cyber defense and incident response effort after a sophisticated intrusion campaign targeted all four major telecommunications operators—M1, SIMBA Telecom, Singtel, and StarHub—according to the Cyber Security Agency of Singapore (CSA) and Minister Josephine Teo. Authorities described the activity as a deliberate, well-planned operation consistent with cyber espionage, prompting a whole-of-government response dubbed Operation Cyber Guardian.
CSA said the attackers achieved unauthorized access to parts of telecom networks and, in at least one case, reached limited portions of critical systems, but reported no service disruptions and no evidence that customer data was accessed or exfiltrated. Singapore attributed the campaign to the China-linked threat actor UNC3886, noting the use of advanced tooling for stealth and persistence; officials also stated that at least one intrusion involved exploitation of a previously unknown software vulnerability, though detailed technical indicators were not publicly released.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
On February 9, 2026, Minister Josephine Teo announced that Singapore had mounted its largest coordinated cyber defense operation in response to the telecom attacks. The government said it would continue joint threat-hunting, penetration testing, and expanded monitoring across the sector to prevent re-entry.
On February 9, 2026, Singapore's Cyber Security Agency publicly attributed the campaign against the country's telecom providers to UNC3886, a China-linked cyberespionage group. Authorities described the operation as deliberate, well-planned, and aimed at maintaining long-term covert access to telecom infrastructure.
By February 2026, Singapore said Operation Cyber Guardian had successfully contained the malicious activity targeting the telecom sector. Officials reported no service disruptions and no evidence that customer information was compromised, though technical data was exfiltrated.
During the campaign, the threat actor obtained unauthorized access to parts of all four major Singapore telecom networks and, in one case, reached limited portions of critical systems. Authorities said the operation used advanced tooling, stealth malware, long-term persistence techniques, and at least one previously unknown software vulnerability.
Following the July 2025 confirmation, Singapore began a nearly year-long multi-agency incident response effort called Operation Cyber Guardian. More than 100 cyber defenders from government, military, intelligence, and telecom operators were mobilized to investigate and contain the intrusion.
In July 2025, Singapore confirmed that a threat actor had been observed attacking critical infrastructure, though authorities withheld detailed public information at the time for national-interest reasons. The activity later proved to involve all four major telecommunications operators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Singapore’s **Cyber Security Agency (CSA)** reported that the China-linked cyber espionage group **UNC3886** conducted a deliberate campaign targeting the country’s telecommunications sector, with **all four major telcos (Singtel, StarHub, M1, and SIMBA Telecom)** confirmed as targets and breached at least once. Authorities assessed the activity as focused on strategic access and intelligence collection rather than disruption; while attackers reached *some* network segments and had limited access to certain critical systems, Singapore reported **no service outages** and **no evidence of customer data theft**. CSA said UNC3886 used **sophisticated tooling**, including **weaponizing a zero-day exploit** to bypass a telco’s perimeter firewall and exfiltrate a small amount of technical data, and deploying **rootkits** to maintain persistence and evade detection. In response, Singapore launched **Operation Cyber Guardian**, with CSA and the **Infocomm Media Development Authority (IMDA)** coordinating a multi-agency investigation and containment effort to close access paths, expand monitoring, and reduce the risk of lateral movement into other critical sectors such as banking, transport, and healthcare; reporting also noted UNC3886’s broader tradecraft of targeting **edge devices** and **virtualization infrastructure** (e.g., VMware ESXi/vCenter) consistent with prior public research linking similar activity to the *Fire Ant* cluster.
Jun 29, 2026
Singapore’s Cyber Security Agency (CSA) reported that a **Chinese cyber-espionage group tracked as UNC3886** compromised all four of the country’s major telecom providers—**M1, SIMBA Telecom, Singtel, and StarHub**—in an intrusion campaign that occurred the prior year and required roughly **11 months** of joint investigation and remediation to evict the threat actor. CSA said investigators found evidence of theft of a **small amount of technical data** intended to enable follow-on access, but did not find evidence of customer data theft; reporting described the tradecraft as involving **firewall zero-days** and **rootkits** for persistence, consistent with UNC3886’s history of targeting enterprise and network infrastructure. Separate reporting and commentary amplified the same telecom-breach narrative and placed it in the broader context of Chinese telco-focused espionage (often compared with **Salt Typhoon**) and UNC3886’s previously documented exploitation of perimeter and virtualization technologies (including **Fortinet, Juniper, Ivanti SecureConnect, and VMware ESXi/vCenter**). Other items in the provided material—such as a weekly roundup covering unrelated incidents (European Commission MDM exposure, Senegal ID disruption, and an Australian regulatory penalty), a law-enforcement story about **IcedID** developers, and a vendor podcast discussing critical-infrastructure threats—do not describe the Singapore telco intrusions and are not part of this specific event.
Jun 29, 2026
Singapore’s Cyber Security Agency (**CSA**) said it worked with the Infocomm Media Development Authority (**IMDA**) and the country’s four major telecom providers—**M1, Simba Telecom, Singtel, and StarHub**—to remove a China-linked threat actor, **UNC3886**, after an extended intrusion effort against telecom networks and systems. The joint operation (“**Cyber Guardian**”) involved more than 100 incident responders and followed detection of a **zero-day exploit used to bypass a perimeter firewall**, along with **rootkits** used for persistence. Authorities reported **no evidence of customer data compromise** and **no disruption** to telecommunications services or Internet access, despite unauthorized access to some systems, including critical systems. Other items in the provided set are largely separate reporting (or opinion/roundups) on unrelated threats, vulnerabilities, and trends—e.g., a Kaspersky-described Android firmware supply-chain backdoor (**Keenadu**), a Notepad++ update-channel compromise attributed to **Lotus Blossom**, and broader industry reporting on RMM abuse, mobile spyware, Chrome zero-days, and ransomware activity. One additional source (Emsisoft) references the Singapore telecom incident only in passing as an example within a broader argument about the state of cybersecurity, and does not add new technical or impact details beyond the CSA-reported event.
Jun 29, 2026