Overview
- Singtel, StarHub, M1 and SIMBA were all targeted in a deliberate, well‑planned espionage campaign attributed to the APT group UNC3886.
- Investigators say a zero‑day exploit was used to bypass a perimeter firewall, with a small amount of technical network data exfiltrated.
- UNC3886 deployed rootkits to maintain stealthy, persistent access, though access to critical systems did not progress far enough to disrupt services.
- CSA and IMDA said segregated high‑sensitivity assets such as 5G networks were not compromised.
- Operation Cyber Guardian mobilized more than 100 defenders across six agencies and the telcos, and authorities warn of possible re‑entry attempts as remediation and expanded monitoring continue alongside the telcos’ defence‑in‑depth commitments.