Singapore Signals Heightened Vigilance Against State-Linked Threat Actors
Singapore said it carried out its largest-ever coordinated cyber defense operation against a threat actor targeting major telecommunications networks across the country as governments worldwide grapple with ongoing digital attacks against communications infrastructure.
See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions
The Cyber Security Agency of Singapore disclosed in a press release that a multi-agency operation lasting nearly a year successfully contained a hack linked to UNC3886.
First described by Mandiant in 2023, the threat actor is a suspected Chinese cyberespionage operation. It infiltrated the Singapore telecommunications sector using stealth malware, zero-day exploits and long-term persistence techniques. The campaign targeted all four major telecommunications providers. Ejecting it involved coordination across more than 100 cyber defenders from government, military and intelligence agencies working alongside private-sector operators, according to the agency.
The defense mission – dubbed Operation Cyber Guardian – began after Singapore’s coordinating minister for cybersecurity confirmed in July that the threat actor had been observed attacking the nation’s critical infrastructure. Officials said attackers were able to access portions of telecommunications infrastructure and extract technical data, but did not disrupt services or compromise customer information.
The previously undisclosed operation comes as telecom providers have become prime targets for state cyberespionage campaigns seeking long-term access to communications data, network infrastructure and potentially sensitive metadata. One of the most consequential examples is the Chinese-linked campaign tracked as Salt Typhoon, which U.S. officials say compromised multiple major American telecommunications providers beginning in 2024 (see: CISA First Spotted Salt Typhoon Hackers in Federal Networks).
Investigators later said that Chinese attackers breached at least nine U.S. telecom and internet service providers, allowing attackers to access call records and communications infrastructure used for lawful surveillance requests. The campaign has been described by national security officials and experts as one of the most widespread cyber campaigns ever conducted against U.S. communications infrastructure (see: Experts See Little Progress After Major Chinese Telecom Hack).
Norway’s Police Security Service also recently confirmed that Chinese-linked threat actors compromised network devices inside Norwegian organizations, marking one of the clearest acknowledgements by a European government that the telecom-focused campaign spread to allied infrastructure (see: Norway Says Salt Typhoon Hackers Hit Vulnerable Systems).
Security researchers warn that advanced campaigns targeting telecom infrastructure often focus on routers, backbone infrastructure and edge networking devices used by providers, enabling long-term surveillance access while remaining difficult to detect. Singapore’s cyber agency said joint threat-hunting, penetration testing and expanded monitoring will continue across the country’s telecom sector as authorities prepare for possible future attempts to regain access.