Log in Request a demo

Significant cyber incident

UNC3886 campaign against Singapore’s telecommunications operators, 2025

In 2025 an advanced persistent threat actor called UNC3886 attacked all four of Singapore's major telecommunications operators.

In short

In 2025 an advanced persistent threat actor called UNC3886 attacked all four of Singapore's major telecommunications operators. Singapore's Cyber Security Agency (CSA) says it used a zero-day exploit to get past a perimeter firewall and rootkits to stay hidden, and took a small amount of technical data. Singapore says there is no evidence that customer data was taken or services were disrupted.

Last updated October 2026

What happened

On 18 July 2025 Singapore’s Coordinating Minister for National Security said in a speech that an advanced persistent threat (APT) actor called UNC3886 was attacking Singapore’s critical infrastructure “right now”. He gave no more detail, and said the Government would decide later whether to say more.

On 9 February 2026 CSA and the Infocomm Media Development Authority (IMDA) shared more. Their investigations showed a deliberate, targeted and well-planned campaign against the telecommunications sector. All four major operators, M1, SIMBA Telecom, Singtel and StarHub, were targets of attacks. The operators detected the activity first and told IMDA and CSA.

The authorities said the actor used a zero-day exploit to bypass a perimeter firewall and took a small amount of technical data, thought to be mainly about the network. In another case it used rootkits to keep access and hide. In one instance it gained limited access to critical systems but did not get far enough to disrupt services.

Singapore mounted Operation CYBER GUARDIAN with more than 100 cyber defenders. It lasted more than eleven months. The authorities say there is no evidence that customer records or other sensitive or personal data were accessed or taken, and none that telecom services were disrupted. The exact dates of the intrusions have not been published.

Timeline

  1. Late 2021

    CSA says, citing cybersecurity vendors, that UNC3886 has been active since at least this time.

  2. 2025, exact dates not published

    The telcos detect the actor's activity and notify IMDA and CSA; Operation CYBER GUARDIAN begins and runs for more than eleven months.

  3. 18 July 2025

    The Coordinating Minister for National Security discloses at CSA's 10th anniversary dinner that UNC3886 is attacking critical infrastructure.

  4. 3 September 2025

    CSA publishes Singapore Cyber Landscape 2024/2025, which names UNC3886 as a group targeting Singapore and calls it state-sponsored.

  5. 31 October 2025

    Amended Cybersecurity Act provisions take effect; owners of critical information infrastructure must report suspected APT incidents to CSA within 2 hours.

  6. 9 February 2026

    CSA and IMDA disclose that all four major telcos were targeted and describe Operation CYBER GUARDIAN; the Digital Development Minister speaks to the defenders.

  7. 27 February 2026

    In a written answer to Parliament the minister explains why the Government made the attacks public.

  8. 30 June 2026

    CSA's Singapore Cyber Landscape 2025/2026 release calls the intrusion attempt on the four operators one of the most significant incidents of 2025.

How the attack worked

Singapore has published few technical details, “to preserve operational security”. What follows is only what CSA, IMDA and the ministers have said. The ATT&CK mapping is our reading of those statements; the sources do not give ATT&CK ids.

Getting in

In one instance the actor used a zero-day exploit, a flaw with no known fix, to bypass a perimeter firewall of the telcos and enter their networks (Exploit Public-Facing Application, T1190). The Government has not named the firewall product or the flaw.

Staying hidden

In another instance the actor used advanced tools such as rootkits to keep access and cover its tracks (Rootkit, T1014). This made it hard to spot and forced defenders to run comprehensive security checks across the networks. In its July 2025 speech the Government said, citing cybersecurity vendors, that UNC3886 has been seen exploiting zero-day flaws in network devices from major vendors and chaining several exploits together. It did not say those products were involved in Singapore.

What it took

The actor took a small amount of technical data, believed to be mainly network-related, to advance its own goals. The Digital Development Minister said this was likely data that helps the actor understand the terrain. In one instance it had limited access to critical systems but could not disrupt services.

How the attack ran
  1. Bypass the firewallA zero-day exploit was used to get past a perimeter firewall of the telcosTechnique T1190 (MITRE ATT&CK, opens in a new tab)
  2. Enter telco networksThe actor gained unauthorized access to parts of telco networks and systems
  3. Stay hiddenRootkits and other tools kept access and hid the actorTechnique T1014 (MITRE ATT&CK, opens in a new tab)
  4. Learn the networkA small amount of technical, network-related data was taken
  5. Reach critical systemsIn one instance limited access to critical systems was gained, but no service was disrupted

Impact

All four major telecommunications operators were targets of attacks, per CSA and IMDA (9 February 2026).
The actor gained unauthorized access to some parts of telco networks and systems. In one instance it had limited access to critical systems but did not get far enough to disrupt services.
A small amount of technical data, believed to be mainly network-related, was taken.
CSA and IMDA say there is no evidence that sensitive or personal data such as customer records was accessed or taken, and no evidence that telecom services such as internet availability were disrupted.
Sources differ in wording: the 9 February 2026 release describes unauthorized access, while CSA's 30 June 2026 release describes an "attempted cyber intrusion" that the operation contained.
The response was Singapore's largest coordinated cyber incident response to date, with more than 100 defenders over more than eleven months.

Government and regulator response

  • Detection and alert: the telcos detected the activity and told IMDA and CSA. CSA, IMDA and other agencies launched a coordinated government response with the telcos.
  • Operation CYBER GUARDIAN: more than 100 cyber defenders from CSA, IMDA, CSIT, the Digital and Intelligence Service, GovTech and the Internal Security Department took part over more than eleven months. It was the first time the national cyber defense doctrine of 2020 was used in a real operation.
  • Containment: defenders remediated, closed UNC3886’s access points and expanded monitoring in the targeted telcos.
  • 18 July 2025: the Government disclosed that UNC3886 was attacking critical infrastructure, without detail.
  • 31 October 2025: amended Cybersecurity Act provisions took effect. Owners of critical information infrastructure must now report incidents suspected of being caused by APTs to CSA within 2 hours.
  • 9 February 2026: CSA and IMDA gave details. They are working with the telcos on joint threat hunting, penetration testing and capability upgrades, and warned that further attempts may follow.
  • 27 February 2026: the Government told Parliament it does not disclose all attacks but wanted the public to know such threats are real.

Lessons

  1. Edge devices are the front line

    One path in was a zero-day exploit against a perimeter firewall. Keep an inventory of edge devices and watch them closely, even when a patch does not yet exist.

  2. Plan for hidden access

    Rootkits made the actor hard to find and forced checks across the networks. Hunt for access, do not wait for alerts.

  3. Detection by the operator worked

    The telcos spotted the activity and told the authorities. Fast reporting started the national response.

  4. Practice the joint response

    Singapore says its 2020 doctrine and years of exercises let the public and private sectors work together in a real operation.

  5. Report suspected state-linked activity quickly

    Since 31 October 2025 owners of critical systems must report suspected APT incidents within 2 hours so CSA can see across sectors.

  6. Expect them to return

    CSA warns that the actor is persistent and that more attempts may follow, so keep monitoring after the clean-up.

What to check in your own organization

  1. Edge inventory

    List every firewall, VPN and network appliance that faces the internet. Record the owner, version and how fast you can patch or isolate it.

  2. Zero-day plan

    Decide what you do when there is no patch yet: extra monitoring, access limits, or taking the device offline.

  3. Rootkit hunting

    Check that you can inspect devices that cannot run an agent, and compare firmware and configurations with known-good copies.

  4. Network data

    Treat network diagrams, configurations and device inventories as sensitive. Check who can copy them.

  5. Reporting clock

    If you run critical systems in Singapore, confirm you can report a suspected APT incident within 2 hours and who calls whom.

  6. Joint threat hunting

    Agree with your regulator or sector lead how to run joint hunts and share indicators.

  7. Re-entry watch

    After a clean-up, keep extra monitoring on the points the actor used.

Questions

Which companies were attacked?

CSA and IMDA say all four of Singapore's major telecommunications operators were targets: M1, SIMBA Telecom, Singtel and StarHub.

Was customer data stolen?

CSA and IMDA say there is no evidence to date that sensitive or personal data such as customer records was accessed or taken. A small amount of technical, network-related data was taken.

Were services disrupted?

CSA and IMDA say there is no evidence that telecom services such as internet availability were disrupted.

Who is UNC3886?

Singapore describes it as an APT actor, called state-sponsored by CSA, active since at least late 2021. It has not been attributed to a known threat actor group, and no country has been named.

What was Operation CYBER GUARDIAN?

Singapore's largest coordinated cyber incident response to date. More than 100 defenders from six agencies worked with the telcos for more than eleven months.

Why did Singapore make it public?

The Minister told Parliament that telecommunications is critical infrastructure, that the Government does not disclose all attacks, and that the public should know such threats are real.

In our research

  1. UNC3886 Threat group

Sources

  1. Largest Multi-Agency Cyber Operation Mounted to Counter Threat Posed by APT Actor UNC3886 to Singapore's Telecommunications Sector (9 February 2026) Cyber Security Agency of Singapore
  2. Opening Speech by Mr K Shanmugam at CSA's 10th Anniversary Dinner (18 July 2025) Cyber Security Agency of Singapore
  3. Opening Speech by Minister Josephine Teo at the Operation CYBER GUARDIAN Engagement Event (9 February 2026) Cyber Security Agency of Singapore
  4. MDDI's Response to PQ on Considerations Behind Government's Recent Announcement of UNC3886 Cyberattacks (27 February 2026) Ministry of Digital Development and Information
  5. A Decade of Strengthening Singapore's Cyber Defence Amid Escalating Threats (3 September 2025) Cyber Security Agency of Singapore
  6. Singapore Cyber Landscape 2024/2025 Cyber Security Agency of Singapore
  7. Provisions in the Cybersecurity (Amendment) Act to Come Into Force on 31 October 2025 Cyber Security Agency of Singapore
  8. CSA's Initiatives to Strengthen Singapore's Cyber Defences Amid an AI-Driven Threat Landscape (30 June 2026) Cyber Security Agency of Singapore

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Advanced persistent threat (APT)

An advanced persistent threat (APT) is a skilled, well-resourced adversary that targets an organization over a long period.

Read more

Glossary term

Zero-day vulnerability

A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.

Read more

Article

How to Uproot Rootkit Threats?

Learn what a rootkit is, how rootkits hide malware and what the report covers on detection, response and rootkit removal for security teams.

Read more