Loading story…
Singapore’s Cyber Security Agency (CSA) reported that the China-linked cyber espionage group UNC3886 conducted a deliberate campaign targeting the country’s telecommunications sector, with all four major telcos (Singtel, StarHub, M1, and SIMBA Telecom) confirmed as targets and breached at least once. Authorities assessed the activity as focused on strategic access and intelligence collection rather than disruption; while attackers reached some network segments and had limited access to certain critical systems, Singapore reported no service outages and no evidence of customer data theft.
CSA said UNC3886 used sophisticated tooling, including weaponizing a zero-day exploit to bypass a telco’s perimeter firewall and exfiltrate a small amount of technical data, and deploying rootkits to maintain persistence and evade detection. In response, Singapore launched Operation Cyber Guardian, with CSA and the Infocomm Media Development Authority (IMDA) coordinating a multi-agency investigation and containment effort to close access paths, expand monitoring, and reduce the risk of lateral movement into other critical sectors such as banking, transport, and healthcare; reporting also noted UNC3886’s broader tradecraft of targeting edge devices and virtualization infrastructure (e.g., VMware ESXi/vCenter) consistent with prior public research linking similar activity to the Fire Ant cluster.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Singapore's Cyber Security Agency publicly disclosed that UNC3886 had targeted all four major telecom providers and attributed the campaign to the China-linked group. Officials said the attackers sought mainly technical network and architecture data, but found no evidence of customer personal data theft or internet and mobile service disruption.
During Operation Cyber Guardian, responders constrained the adversary's activity, remediated exploited access points, and expanded monitoring to prevent further movement into telecom and other critical infrastructure networks. Authorities said the compromise was contained before it could cause service disruption or deeper damage.
Singapore launched Operation Cyber Guardian in response to the UNC3886 intrusions, mounting what officials described as the country's largest multi-agency cyber operation. The effort lasted more than 11 months and involved over 100 investigators and cyber experts from multiple government agencies working with the telcos to contain the threat.
After the intrusions were detected, the affected telecommunications providers reported suspicious activity to Singapore authorities. This triggered a coordinated government response led by the Cyber Security Agency of Singapore and the Infocomm Media Development Authority.
Singapore later said the China-linked espionage group UNC3886 targeted Singtel, StarHub, M1, and SIMBA Telecom during 2025, using advanced techniques including a zero-day exploit to bypass a perimeter firewall and rootkits to maintain stealth and persistence. The intrusions resulted in unauthorized access to parts of telco networks, including limited access to critical systems in at least one case.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
11 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourceteiss.co.uk
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcedatabreaches.net
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcecsa.gov.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Singapore’s Cyber Security Agency (CSA) reported that a **Chinese cyber-espionage group tracked as UNC3886** compromised all four of the country’s major telecom providers—**M1, SIMBA Telecom, Singtel, and StarHub**—in an intrusion campaign that occurred the prior year and required roughly **11 months** of joint investigation and remediation to evict the threat actor. CSA said investigators found evidence of theft of a **small amount of technical data** intended to enable follow-on access, but did not find evidence of customer data theft; reporting described the tradecraft as involving **firewall zero-days** and **rootkits** for persistence, consistent with UNC3886’s history of targeting enterprise and network infrastructure. Separate reporting and commentary amplified the same telecom-breach narrative and placed it in the broader context of Chinese telco-focused espionage (often compared with **Salt Typhoon**) and UNC3886’s previously documented exploitation of perimeter and virtualization technologies (including **Fortinet, Juniper, Ivanti SecureConnect, and VMware ESXi/vCenter**). Other items in the provided material—such as a weekly roundup covering unrelated incidents (European Commission MDM exposure, Senegal ID disruption, and an Australian regulatory penalty), a law-enforcement story about **IcedID** developers, and a vendor podcast discussing critical-infrastructure threats—do not describe the Singapore telco intrusions and are not part of this specific event.
Jun 29, 2026
Singapore launched its largest coordinated cyber defense and incident response effort after a sophisticated intrusion campaign targeted **all four major telecommunications operators**—**M1, SIMBA Telecom, Singtel, and StarHub**—according to the Cyber Security Agency of Singapore (CSA) and Minister Josephine Teo. Authorities described the activity as a deliberate, well-planned operation consistent with **cyber espionage**, prompting a whole-of-government response dubbed **Operation Cyber Guardian**. CSA said the attackers achieved **unauthorized access** to parts of telecom networks and, in at least one case, reached **limited portions of critical systems**, but reported **no service disruptions** and **no evidence** that customer data was accessed or exfiltrated. Singapore attributed the campaign to the China-linked threat actor **UNC3886**, noting the use of advanced tooling for stealth and persistence; officials also stated that at least one intrusion involved exploitation of a **previously unknown software vulnerability**, though detailed technical indicators were not publicly released.
Jun 29, 2026
Singapore’s Cyber Security Agency (**CSA**) said it worked with the Infocomm Media Development Authority (**IMDA**) and the country’s four major telecom providers—**M1, Simba Telecom, Singtel, and StarHub**—to remove a China-linked threat actor, **UNC3886**, after an extended intrusion effort against telecom networks and systems. The joint operation (“**Cyber Guardian**”) involved more than 100 incident responders and followed detection of a **zero-day exploit used to bypass a perimeter firewall**, along with **rootkits** used for persistence. Authorities reported **no evidence of customer data compromise** and **no disruption** to telecommunications services or Internet access, despite unauthorized access to some systems, including critical systems. Other items in the provided set are largely separate reporting (or opinion/roundups) on unrelated threats, vulnerabilities, and trends—e.g., a Kaspersky-described Android firmware supply-chain backdoor (**Keenadu**), a Notepad++ update-channel compromise attributed to **Lotus Blossom**, and broader industry reporting on RMM abuse, mobile spyware, Chrome zero-days, and ransomware activity. One additional source (Emsisoft) references the Singapore telecom incident only in passing as an example within a broader argument about the state of cybersecurity, and does not add new technical or impact details beyond the CSA-reported event.
Jun 29, 2026