Singapore says China-backed hackers targeted its four largest phone companies

The government of Singapore has officially attributed a series of cyber-attacks against its leading telecommunications companies to a recognized Chinese hacking group. Known as UNC3886, this group has been implicated in a prolonged assault on the nation’s telecom infrastructure, which includes major players like Singtel, StarHub, M1, and Simba Telecom. In a statement released on Monday, Singapore's authorities acknowledged that while the hackers succeeded in breaching certain systems, they did not manage to disrupt services or access sensitive personal data. K. Shanmugam, the country’s coordinating minister for national security, emphasized that the situation is being closely monitored and managed. Cybersecurity experts from Mandiant, a subsidiary of Google, have previously identified UNC3886 as an espionage group believed to be acting on behalf of the Chinese government. This group is notorious for its cyber-espionage operations and is suspected of preparing for potential disruptive attacks, particularly in light of ongoing tensions surrounding Taiwan. UNC3886 is recognized for exploiting zero-day vulnerabilities in various network environments, which are often overlooked by standard cybersecurity measures. The group has targeted sectors such as defense, technology, and telecommunications across the United States and the Asia-Pacific region. According to Minister Shanmugam, the attackers employed sophisticated methods, including rootkits, to establish a persistent presence within the systems of Singapore's telecoms. He noted that while the hackers gained limited access to crucial systems, they did not reach a point where they could disrupt services. In a joint response, the telecom companies stated that they routinely encounter various cyber threats, including distributed denial-of-service attacks. They reassured the public that they implement comprehensive security measures and promptly address any issues that arise. Singapore’s experience with UNC3886 stands in contrast to the more severe impacts seen in similar attacks globally, particularly those attributed to another China-backed group known as Salt Typhoon, which has targeted hundreds of telecom firms around the world, including in the U.S.