On 9 February 2026, Singapore did something governments rarely do: it told the public, in detail, how a state-level hacking group had been sitting inside its four biggest telecom networks, and how long it took to get them out. The group is tracked as UNC3886. The targets were M1, SIMBA Telecom, Singtel and StarHub. The clean-up, called Operation CYBER GUARDIAN, ran for about eleven months and pulled in more than 100 defenders from six government agencies.
Most coverage led with “China-backed hackers”. That framing is worth unpacking, because it isn’t quite what Singapore said, and the difference matters if you care about how these incidents are reported. Below is what was actually disclosed, what UNC3886 is known for, and what the attack tells anyone who runs network infrastructure, whether that’s a national carrier or a handful of firewalls in front of a small company.
What Singapore actually disclosed
The official source is the Cyber Security Agency of Singapore (CSA) press release. The key points:
- How they got in: in at least one case, the attackers used a zero-day exploit to get past a perimeter firewall. The vulnerable product wasn’t named.
- How they stayed in: rootkits, which let an intruder keep hidden, persistent access and cover their tracks.
- How far they got: limited access to some critical systems, but according to CSA not far enough to disrupt services.
- What was taken: a small amount of technical and network data. CSA said there was no evidence that customer records or other personal data were accessed or exfiltrated.
- Who responded: CSA, IMDA, the Centre for Strategic Infocomm Technologies, the Digital and Intelligence Service, GovTech and the Internal Security Department. CSA called it Singapore’s largest coordinated cyber incident response to date.
Josephine Teo, the Minister for Digital Development and Information, was blunt about what could have happened. As Mothership reported, she said that if the attack had gone far enough, it could have allowed the attacker to one day cut off telecoms or internet services.
That sentence is the real story. Espionage is bad. Pre-positioned access that could be used to switch off a country’s phone and internet service is a different category of problem.
The timeline
This didn’t come out of nowhere. In July 2025, Coordinating Minister for National Security K. Shanmugam publicly named UNC3886 as a threat actor attacking Singapore’s critical infrastructure. At the time he didn’t say which sectors. The February 2026 announcement filled in that gap: the telecom sector was the main target, and defenders had been working the incident since before that July speech.
Eleven months is a long time to be evicting an intruder. It tells you something about the adversary. Groups that live on firewalls, routers and hypervisors are hard to remove, because those are exactly the places where most organisations have the least visibility. There’s no endpoint agent on a firewall, and very few teams are checking the integrity of their hypervisor hosts.
Who is UNC3886?
“UNC” is Mandiant’s label for an uncategorised threat cluster: a group of activity it tracks but hasn’t merged into one of its named APT groups. Mandiant (now part of Google Cloud) has published on UNC3886 several times since 2022 and describes it as a highly capable, China-nexus espionage group. Its signature is attacking the parts of a network that security tools usually can’t see:
- Virtualisation: backdoors planted on VMware ESXi hosts and abuse of vCenter, so the attacker sits underneath the virtual machines instead of inside them.
- Network appliances: exploitation of Fortinet firewalls and, in a 2025 report, custom backdoors on end-of-life Juniper routers.
- Zero-days: a track record of using vulnerabilities before vendors have patches for them.
The Hacker News write-up of the Singapore case notes the same focus on edge devices and virtualisation, and links it to earlier research on overlapping activity.
“China-backed”: what was said and what wasn’t
Here’s the nuance. Security researchers, including Mandiant, describe UNC3886 as China-nexus. That’s where the “China-backed” headlines come from. But the Singapore government itself did not name a country. Both the July 2025 speech and the February 2026 statement refer only to UNC3886, an “advanced persistent threat actor”.
That’s a deliberate choice, and a common one for smaller states. Public attribution to a specific government is a diplomatic act, not just a technical finding. Singapore gave the public and industry what they needed to act on, meaning the group’s name, techniques and targets, without making a formal accusation against a country it has deep economic ties with.
For readers, the practical takeaway is to be careful with headlines that put words in a government’s mouth. “Researchers link the group to China” and “Singapore says China did it” are different statements.
How this compares with Salt Typhoon
It’s tempting to lump this in with Salt Typhoon, the China-linked campaign that compromised multiple US telecom carriers and was disclosed in late 2024. The two share a target, telecom networks, and a broad goal, intelligence collection. But they’re tracked as different groups, and Singapore was careful to say its incident had not caused the same extent of damage seen elsewhere.
What they have in common is more useful than what separates them. In both cases, attackers went after carrier infrastructure because that’s where the valuable view of a country’s communications sits, and in both cases the way in ran through network equipment rather than laptops or email.
What the telcos said
The four operators issued a joint statement saying they use defence-in-depth, fix issues promptly when they’re detected, and will keep updating their measures with government agencies and industry partners. It’s a standard statement. The more telling part is the one CSA itself made: the attackers were stopped before they could disrupt service, but they did reach critical systems. Defence-in-depth worked in the sense that no single breached layer led to an outage. It didn’t stop the initial compromise.
Lessons for anyone running network infrastructure
You don’t need to be a national carrier to take something from this. The same techniques show up against much smaller targets, just with less media coverage. A few things are worth checking on your own network:
1. Treat edge devices as high-value servers
Firewalls, VPN gateways and routers are internet-facing and often run old firmware. Keep an inventory with firmware versions, subscribe to your vendors’ security advisories, and have a plan for patching them quickly. Retire equipment that has reached end-of-life. UNC3886’s Juniper activity specifically targeted routers that no longer got updates.
2. Get logs off the appliance
A rootkit on a device can tamper with local logs. Ship firewall, router and hypervisor logs to a separate system the attacker can’t easily reach, and keep them long enough to investigate an intrusion that may have started months earlier.
3. Lock down management interfaces
Management planes for ESXi, vCenter and network gear shouldn’t be reachable from general user networks, let alone the internet. Put them on a separate management network, require MFA where the product supports it, and audit who has admin accounts.
4. Verify integrity, not just availability
Most monitoring asks “is the device up?” Few teams ask “is it still running the firmware we installed?” Vendors increasingly ship integrity-check tools for exactly this. Use them after any suspicious event.
5. Assume patient attackers
An eleven-month response means the intrusion was careful and quiet. Incident response plans that assume a smash-and-grab won’t hold up. Practise for the scenario where you find an intruder who has been in place for a long time and is watching you respond.
Why this disclosure matters
Singapore could have handled this quietly. Instead it published the attacker’s name, the entry method, the persistence technique and an honest statement of what was taken. That kind of transparency helps every other operator in the region check for the same activity. It also sets an example worth following: say clearly what happened, what didn’t, and what you still don’t know.
If you run infrastructure, the uncomfortable question this raises is simple: if someone had been sitting on your firewall for a year, would you know?
Related reading
- AirSnitch Explained: How Researchers Broke Wi-Fi Client Isolation
- The FCC’s Foreign Router Ban Explained
- The Xbox One “Bliss” Hack Explained
Sources: Cyber Security Agency of Singapore, The Hacker News, Mothership.
