UNC3886 – China-Linked Espionage Hits Singapore's Telcos

Tech Talks With Kinsoft · Mar 5, 2026 · 19m · transcript

Singapore's Cyber Security Agency attributed a sophisticated espionage campaign against all four major telcos — M1, SIMBA, Singtel and StarHub — to the China-nexus group UNC3886. Active since around July 2025, the attackers exploited Fortinet and VMware zero-days plus advanced Linux rootkits to hold persistent access for close to a year before being evicted. The response, Operation Cyber Guardian, ran more than eleven months with 100+ defenders. Officials found no evidence that customer personal data was exfiltrated and services were not disrupted — the goal was intelligence-gathering on…