Breaches and incidentsBriefChecked against a primary source
Singapore: UNC3886 inside all four major telcos; Operation CYBER GUARDIAN
CSA: UNC3886 targeted M1, SIMBA, Singtel and StarHub, gained limited access to some critical systems and exfiltrated a small amount of mainly...
- Disclosed
What happened
- CSA: UNC3886 targeted M1, SIMBA, Singtel and StarHub, gained limited access to some critical systems and exfiltrated a small amount of mainly network-related technical data; no evidence of customer data access or service disruption. The response ran 11+ months with 100+ defenders from CSA, IMDA, CSIT, DIS, GovTech and ISD.
- Technique: a zero-day to bypass a perimeter firewall; rootkits for persistence. CVE not disclosed.
- Attribution: CSA names “APT actor UNC3886” without naming a state (industry ties UNC3886 to China).
Sources
- https://www.csa.gov.sg/news-events/press-releases/largest-multi-agency-cyber-operation-mounted-to-counter-threat-posed-by-advanced-persistent-threat--apt--actor-unc3886-to-singapore-s-telecommunications-sector/
- https://thehackernews.com/2026/02/china-linked-unc3886-targets-singapore.html
- https://www.helpnetsecurity.com/2026/02/10/singapore-telecommunications-unc3886-cyber-espionage/
- https://www.theregister.com/2026/02/10/singapore_telco_espionage/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.