Loading story…
Singapore’s Cyber Security Agency (CSA) said it worked with the Infocomm Media Development Authority (IMDA) and the country’s four major telecom providers—M1, Simba Telecom, Singtel, and StarHub—to remove a China-linked threat actor, UNC3886, after an extended intrusion effort against telecom networks and systems. The joint operation (“Cyber Guardian”) involved more than 100 incident responders and followed detection of a zero-day exploit used to bypass a perimeter firewall, along with rootkits used for persistence. Authorities reported no evidence of customer data compromise and no disruption to telecommunications services or Internet access, despite unauthorized access to some systems, including critical systems.
Other items in the provided set are largely separate reporting (or opinion/roundups) on unrelated threats, vulnerabilities, and trends—e.g., a Kaspersky-described Android firmware supply-chain backdoor (Keenadu), a Notepad++ update-channel compromise attributed to Lotus Blossom, and broader industry reporting on RMM abuse, mobile spyware, Chrome zero-days, and ransomware activity. One additional source (Emsisoft) references the Singapore telecom incident only in passing as an example within a broader argument about the state of cybersecurity, and does not add new technical or impact details beyond the CSA-reported event.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Singapore publicly disclosed that a China-linked threat actor, UNC3886, had targeted some of the country’s telecom networks and systems. The disclosure highlighted the operation’s scale, the use of advanced tooling, and the government’s coordinated work with all four major telcos over 11 months.
During and after the response, the Cyber Security Agency and IMDA said they found no evidence that personal data was compromised and no evidence of telecommunications or Internet service disruption. The response also included containment and hardening measures across the affected environments.
Singapore government cyber responders and the country’s four major telecom providers began a joint operation dubbed 'Cyber Guardian' to remove the China-linked actor from affected telecom networks. The actor had used a zero-day exploit to bypass a perimeter firewall and rootkits to maintain persistence, including access to some critical systems.
Singapore’s major telecom providers detected suspicious activity in their networks and notified the Infocomm Media Development Authority and Cyber Security Agency, triggering a coordinated national response. The threat actor was later identified as UNC3886.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Singapore’s Cyber Security Agency (CSA) reported that a **Chinese cyber-espionage group tracked as UNC3886** compromised all four of the country’s major telecom providers—**M1, SIMBA Telecom, Singtel, and StarHub**—in an intrusion campaign that occurred the prior year and required roughly **11 months** of joint investigation and remediation to evict the threat actor. CSA said investigators found evidence of theft of a **small amount of technical data** intended to enable follow-on access, but did not find evidence of customer data theft; reporting described the tradecraft as involving **firewall zero-days** and **rootkits** for persistence, consistent with UNC3886’s history of targeting enterprise and network infrastructure. Separate reporting and commentary amplified the same telecom-breach narrative and placed it in the broader context of Chinese telco-focused espionage (often compared with **Salt Typhoon**) and UNC3886’s previously documented exploitation of perimeter and virtualization technologies (including **Fortinet, Juniper, Ivanti SecureConnect, and VMware ESXi/vCenter**). Other items in the provided material—such as a weekly roundup covering unrelated incidents (European Commission MDM exposure, Senegal ID disruption, and an Australian regulatory penalty), a law-enforcement story about **IcedID** developers, and a vendor podcast discussing critical-infrastructure threats—do not describe the Singapore telco intrusions and are not part of this specific event.
Jun 29, 2026
Singapore’s **Cyber Security Agency (CSA)** reported that the China-linked cyber espionage group **UNC3886** conducted a deliberate campaign targeting the country’s telecommunications sector, with **all four major telcos (Singtel, StarHub, M1, and SIMBA Telecom)** confirmed as targets and breached at least once. Authorities assessed the activity as focused on strategic access and intelligence collection rather than disruption; while attackers reached *some* network segments and had limited access to certain critical systems, Singapore reported **no service outages** and **no evidence of customer data theft**. CSA said UNC3886 used **sophisticated tooling**, including **weaponizing a zero-day exploit** to bypass a telco’s perimeter firewall and exfiltrate a small amount of technical data, and deploying **rootkits** to maintain persistence and evade detection. In response, Singapore launched **Operation Cyber Guardian**, with CSA and the **Infocomm Media Development Authority (IMDA)** coordinating a multi-agency investigation and containment effort to close access paths, expand monitoring, and reduce the risk of lateral movement into other critical sectors such as banking, transport, and healthcare; reporting also noted UNC3886’s broader tradecraft of targeting **edge devices** and **virtualization infrastructure** (e.g., VMware ESXi/vCenter) consistent with prior public research linking similar activity to the *Fire Ant* cluster.
Jun 29, 2026
Singapore launched its largest coordinated cyber defense and incident response effort after a sophisticated intrusion campaign targeted **all four major telecommunications operators**—**M1, SIMBA Telecom, Singtel, and StarHub**—according to the Cyber Security Agency of Singapore (CSA) and Minister Josephine Teo. Authorities described the activity as a deliberate, well-planned operation consistent with **cyber espionage**, prompting a whole-of-government response dubbed **Operation Cyber Guardian**. CSA said the attackers achieved **unauthorized access** to parts of telecom networks and, in at least one case, reached **limited portions of critical systems**, but reported **no service disruptions** and **no evidence** that customer data was accessed or exfiltrated. Singapore attributed the campaign to the China-linked threat actor **UNC3886**, noting the use of advanced tooling for stealth and persistence; officials also stated that at least one intrusion involved exploitation of a **previously unknown software vulnerability**, though detailed technical indicators were not publicly released.
Jun 29, 2026