Singapore

This page covers cyber threats to Singapore. It brings together official Singapore texts (the Cyber Security Agency of Singapore CSA, the Infocomm Media Development Authority IMDA, the Ministry of Digital Development and Information, the Ministry of Home Affairs speeches and the Committee of Inquiry into the SingHealth attack), US government advisories and Brandefense research. Where an official source names Singapore as a target, the page says who said it and when.

Threat groups that official sources link to Singapore

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

Lazarus Group: the US advisory AA21-048A lists Singapore among the countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. The FBI, CISA and Treasury attribute the Lazarus Group to North Korean state-sponsored actors.

APT38: a 2020 advisory from US agencies (AA20-239A) says the North Korean group it calls BeagleBoyz likely targeted financial institutions in a list of nations since 2015, and Singapore is on that list. The advisory says the BeagleBoyz overlap to varying degrees with Lazarus Group and APT38.

Singapore also names a group of its own. On 18 July 2025 the Coordinating Minister for National Security said an advanced persistent threat (APT) actor called UNC3886 was attacking Singapore’s critical infrastructure, and on 9 February 2026 CSA and IMDA said it had targeted all four major telecommunications operators. The Government says UNC3886 has yet to be attributed to a known threat actor group. CSA calls it state-sponsored. It has no profile in our library yet.

Incidents on record

The incidents listed below are the major ones that the Singapore Government or the affected organizations reported, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

What Singapore’s own agencies report

The Coordinating Minister for National Security said on 18 July 2025 that a survey showed nearly 80 percent of organizations have experienced some form of cyber attack, and that detected incidents with suspected APT activity in Singapore more than quadrupled between 2021 and 2024. He named earlier APT cases: a 2014 breach of the Ministry of Foreign Affairs, the 2017 breach of two universities, the 2018 SingHealth attack and a 2024 global botnet that included about 2,700 devices in Singapore.

CSA says ransomware cases reported to the authorities rose from 132 in 2023 to 159 in 2024 and 165 in 2025, and that small and medium-sized enterprises were disproportionately affected. It says phishing attempts reported to CSA fell 21 percent to about 4,800 in 2025, while infected infrastructure detected in Singapore rose 142 percent to 284,300, a rise it ties to persistent malicious infrastructure activity and better detection of infected botnet devices. CSA also says most infections in 2024 involved old malware that users had not cleaned up.

How attackers target Singapore: Brandefense research

Our own posts mention Singapore only in passing. In summary, as they report:

State-linked espionage: the Ocean Lotus (APT32) profile lists Singapore among the countries targeted by the group, which is active in Vietnam and other Southeast Asian countries. The LIMINAL PANDA profile says that in 2023 the actor ran phishing intrusions against defense research organizations in Singapore and South Korea.

Ransomware: our DragonForce article says open reporting has named a Singapore business among organizations linked to the group and adds that not every claim may be watertight.

How Brandefense helps

Singapore’s agencies stress that public and private organizations defend together. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Cybersecurity Act came into force on 31 August 2018, and CSA designated all Critical Information Infrastructure (CII) by 31 December 2018. CII owners must follow the Cybersecurity Code of Practice, report incidents within set times and run regular risk assessments and audits. The CII sectors are Energy, Water, Banking and Finance, Healthcare, Transport, Infocomm, Media, Security and Emergency Services, and Government. The Act lets the Commissioner of Cybersecurity investigate threats and incidents, and CSA licenses providers of penetration testing and managed security operations center monitoring.

An amending Act passed on 7 May 2024, and key provisions took effect on 31 October 2025. Owners of CII must now report incidents suspected of being caused by APTs to CSA within 2 hours, and CSA can regulate temporary high-risk systems, such as systems that support elections. The Singapore Cybersecurity Strategy 2021, first launched in 2016, has three pillars (resilient infrastructure, a safer cyberspace and international cyber cooperation) and two enablers (the cybersecurity ecosystem and the talent pipeline).

How incident response is organized

CSA was formed in 2015, sits in the Prime Minister’s Office and is managed by the Ministry of Digital Development and Information. The Singapore Cyber Emergency Response Team (SingCERT) at CSA responds to incidents for Singapore and can be reached at singcert@csa.gov.sg. In 2020 agencies wrote a classified national cyber defense doctrine that sets the roles of the public and private sectors. The response to the UNC3886 telecommunications campaign was the first time it was used in a real operation, with more than 100 defenders from six government agencies working with the telcos. CSA also runs national exercises: Exercise Cyber Star in 2025 involved close to 500 participants from 11 CII sectors. Singapore is a pioneering member of the Counter Ransomware Initiative, which has over 70 member countries.

Personal data

The Personal Data Protection Commission (PDPC) enforces the Personal Data Protection Act. In the SingHealth case it found both the health IT agency IHiS and SingHealth in breach and imposed S$750,000 and S$250,000, the highest penalties it had set at the time.

Beyond the CSA figures above, the official sources opened do not give attack counts by sector. Further figures for Singapore will come from Brandefense Atlas.