All of Singapore's main telecom operators were breached last year by a China-linked actor, prompting a multi-agency cybersecurity response in the island state.

According to Singapore’s Cyber Security Agency (CSA), Singtel, StarHub, M1, and Simba Telecom were victims of cyber group UNC3886, which was responsible for a 2024 attack on Juniper Networks' Junos OS routers.

Alarms were first raised to the CSA in March 2025 when hackers managed to breach certain sections of the telecom systems of each vendor, with no reported disruption of services or access to any personal data. The attacks saw a small amount of technical data swiped in the intrusions, which the CSA believed to consist mainly of network‑related data used to advance the attackers’ operational objectives.

The group initially breached the network by exploiting a zero-day vulnerability, while using rootkits to maintain persistent access and evade detection. One of these kits was the open-source Medusa tool, as used in the attacks on Juniper routers, which implements dynamic linker hijacking by logging user credentials from successful authentications, either locally or remotely, along with command executions.

In response to the Singapore breaches, the CSA launched a multi-agency response with Infocomm Media Development Authority (IMDA), an operation spanning almost a year and which saw the participation of more than one hundred so-called cybersecurity defenders.

"Under Operation Cyber Guardian, the authorities worked closely with the telcos to limit UNC3886’s movement into the networks and ensure our systems remain safe to use," CSA wrote. "So far, the attack by UNC3886 has not resulted in the same extent of damage as cyberattacks elsewhere."

Those attacks have dated back to 2021, with the group targeting VMware software such as the ESXi hypervisor tool. In 2023, Google’s Mandiant Incident Response dubbed UNC3886 as a “China-nexus espionage group,” similar to actors behind Salt Typhoon and the hypervisor-focused Fire Ant campaign.

In a statement given to The Straits Times, Singapore's Chinese Embassy denied all involvement in the telecom attacks, adding China clamped down on all forms of cyberattacks in accordance with the law.