SINGAPORE and its four major telcos—M1, Simba Telecom, Singtel, and StarHub—fought a China-linked cyberthreat actor for 11 months in what the Cyber Security Agency (CSA) described as Cyber Guardian, a multi-agency operation that relied on more than 100 incident responders.
According to the CSA, the attacker, UNC3886, deployed advanced tools including a zero-day exploit to bypass a perimeter firewall and rootkits to maintain persistence, and initial detections came from the telcos themselves who alerted IMDA and CSA. While no evidence emerged of compromised personal data or service disruptions, the attackers did gain unauthorized access to some networks and critical systems.
The incident underscores the value of strong public-private collaboration, transparency in attribution, and resilience measures that helped keep telecommunications services largely unaffected, according to CSA’s incident report. The CSA and IMDA stated that UNC3886’s 11-month presence targeted Singapore’s telecommunications sector and that authorities remain vigilant for future state-sponsored attempts against critical infrastructure.