Latest / Tech Talks With Kinsoft / UNC3886 – China-Linked Espionage Hits Singapore's Telcos

Transcript

UNC3886 – China-Linked Espionage Hits Singapore's Telcos · Tech Talks With Kinsoft

0:00
Imagine opening your phone right now. You know,
0:02
you look at it, you have full bars. Yeah, your
0:04
texts are sending instantly. Exactly. The internet
0:07
is lightning fast. Everything just looks and
0:09
feels completely perfect. Right. But what if
0:12
I told you that for the last year or so, elite
0:15
hackers have been, well, quietly sitting inside
0:19
your mobile carrier, just watching the data flow.
0:22
Wow. And their ultimate goal. was to make sure
0:24
you literally never noticed a single thing. That
0:27
is entirely the point of what we're looking at
0:29
today. Right. Welcome to Tech Talks with Kinsoft.
0:32
Today we are exploring a massive, really highly
0:35
complex cyber espionage campaign that targeted
0:39
the absolute backbone of Singapore's telecommunications
0:42
infrastructure. It's a huge story. It really
0:45
is. We're looking at a threat actor that infiltrated
0:47
four major telcos, all without breaking anything.
0:50
We're going to talk about the incredibly advanced
0:51
tools they use to pull off this silent invasion
0:55
and what this quiet siege reveals about the future
0:59
of global cyber operations. The details coming
1:02
out of this incident, they really subvert everything
1:05
we're usually taught to expect from a cyber attack.
1:08
Yeah, absolutely. You know, we're sort of conditioned
1:10
to look for flashing red screens or locked files
1:15
or, I don't know, massive Internet outages. Ransomware
1:19
notes, right? Exactly, ransomware notes. But
1:21
the reality we're looking at today provides this
1:23
masterclass in how modern state -level cyber
1:27
operations actually function in the real world.
1:31
Prioritizing stealth above all else. Right. So
1:34
the news broke via a statement from the Cybersecurity
1:36
Agency of Singapore, or the CSA. Yeah. And they
1:40
laid out the facts regarding a threat actor known
1:42
to the cybersecurity community as UNC3886. Catchy
1:46
name. Right. Very catchy. So the CSA described
1:48
this as a deliberate, targeted, and well -planned
1:51
attack. And they didn't just hit one vulnerable
1:53
company. No, they didn't. They hit all four of
1:56
Singapore's top telecommunications providers.
1:58
So that's Singtel, Starhub, M1 and Simba Telecom.
2:03
And to really understand the staggering scope
2:05
of hitting all four top providers, you have to
2:08
understand the adversary here. OK, let's get
2:10
into that. Who is UNC 38886? Well, they are not
2:14
a loose collective of amateur hackers looking
2:16
for a quick ransom payout, right? They're not
2:18
kids in a basement. Exactly. Cybersecurity researchers
2:21
at Google, specifically their cybersecurity unit
2:24
Mandiant, they've tracked this group pretty extensively.
2:27
And they categorize them as highly disciplined
2:29
and... Well, incredibly stealthy. And they link
2:33
UNC 3886 as an espionage group likely working
2:37
on behalf of China. OK. And we should definitely
2:40
state clearly for you listening that, you know,
2:43
we are just reporting the findings from these
2:44
specific cybersecurity firms and government incident
2:47
responders. Right. Absolutely. Because Beijing
2:50
routinely and repeatedly. denies conducting any
2:54
cyber espionage operations abroad. Yeah, their
2:57
official stance is a very consistent denial of
2:59
these kinds of state -backed hacking allegations.
3:02
And, you know, the Chinese embassy in Singapore,
3:04
they didn't publicly respond to the specific
3:07
disclosure. So our focus is strictly on the technical
3:09
forensics. Just the mechanics of the event itself.
3:11
Right. And those technical forensics, they point
3:14
to a group. that operates with a very, very specific
3:18
strategic mindset. They are not looking to make
3:20
noise. Which brings up a really glowing question.
3:23
Yeah. If a highly advanced group manages to compromise
3:27
the core infrastructure of an entire country's
3:30
top four phone companies. The literal bedrock
3:34
of their communication. Exactly. Why didn't the
3:36
Internet go down? I mean if you have the keys
3:39
to the castle across four different networks,
3:41
why not turn off the lights and cause some chaos?
3:44
Well, because causing chaos alerts the administrators
3:47
that you are inside the network. Oh. Yeah. We
3:50
are so used to seeing, you know, ransomware gangs
3:53
locking up hospital databases. Right. Or denial
3:56
of service attacks taking down banking websites.
3:58
Those attacks are allowed by design. Because
4:01
they want you to know they're there. Right. Because
4:02
they demand attention or extortion. They want
4:04
to get paid. Got it. But if your goal is long
4:07
term intelligence gathering, the absolute worst
4:09
thing you can do is break a server or disrupt
4:13
a routing protocol. Because a dropped connection
4:15
triggers a support ticket. Exactly. A support
4:18
ticket brings a network engineer to investigate.
4:20
That engineer pokes around and then they find
4:22
your malware. So silence is literally the only
4:25
way to maintain persistence. So the methodology
4:28
requires completely avoiding the standard alarms.
4:31
Yes. And UNC386 achieved this. By bypassing standard
4:36
malware entirely. OK, so what do they use? Well,
4:39
you won't find them using a generic Trojan. You
4:41
might, you know, accidentally download from a
4:43
phishing email. They specifically deployed zero
4:46
day vulnerabilities in foundational network systems.
4:49
Right. Zero days. And just to underscore the
4:51
gravity of that for anyone, you know, tracking
4:53
the economics of cyber warfare. Yeah. A zero
4:55
day is a vulnerability. completely unknown to
4:59
the software vendor. Hence the name. You have
5:01
zero days to patch it. Right. There is no patch
5:03
because the creator literally doesn't know the
5:05
flaw exists. Exactly. And developing or purchasing
5:08
a reliable zero day, I mean, that can cost millions
5:11
of dollars in the exploit market. Oh, absolutely.
5:14
Millions. So you don't burn a multi -million
5:16
dollar asset just to deface a website. No, you
5:20
burn it to gain a master key. Wow. And UNC3886,
5:24
they didn't just target one type of software.
5:27
They deployed zero days across a variety of foundational
5:30
systems. Like what kind of systems? Well, vulnerabilities
5:33
in Fortinet firewalls, VMware virtualized environments,
5:38
and even custom backdoors deployed on Juniper
5:41
routers. Okay, so these are the heavy -duty enterprise
5:43
-grade systems that literally route the Internet
5:47
and build the perimeter defenses for massive
5:50
corporations. Yep. They went straight for the
5:53
load -bearing wall. It sounds like instead of
5:55
kicking down the front door and tripping the
5:56
alarm, the burglars sort of acquired a hidden
6:01
blueprint to the building. Right. Slipped into
6:03
the ventilation shafts and built an entirely
6:06
hidden room where the security guards literally
6:08
aren't capable of patrolling. That ventilation
6:11
shaft analogy works perfectly, actually, when
6:13
we talk about targeting VMware. Okay, break that
6:15
down for me. Let's look at the mechanics of why
6:17
VMware is such a critical target. In a modern
6:19
telco, they aren't running thousands of individual
6:21
physical computers, right? No, of course not.
6:24
They run massive server racks and they use software
6:26
called a hypervisor. like VMware, to create hundreds
6:30
of virtual machines on a single physical box.
6:33
Right. And the hypervisor sits underneath the
6:35
operating systems. Meaning it controls the environment
6:38
the operating systems live inside. Exactly. Therefore,
6:41
if you deploy standard enterprise security software
6:43
like an antivirus or endpoint detection system.
6:46
Yeah. It gets installed inside the Windows or
6:49
Linux operating system. It can only see what
6:51
the operating system sees. Oh, I see where this
6:53
is going. Yeah. If UNC -3886 compromises the
6:57
hypervisor level beneath it, they are invisible.
7:00
Wow. The security tools literally cannot reach
7:03
down into that foundational layer to spot the
7:06
anomaly. So they are operating in the absolute
7:08
blind spots of the network architecture. Precisely.
7:11
And the forensics show they went even further
7:13
to ensure they stayed invisible, right? I mean,
7:16
Singapore's Coordinating Minister for National
7:18
Security, Kay Shanmugam, noted that the hackers
7:21
used advanced tools like Linux rootkits. Yeah,
7:24
rootkits. Rootkits are fascinating pieces of
7:26
engineering. Because they hide things, right?
7:28
Right. Their primary function is to intercept
7:30
commands at the kernel level of an operating
7:32
system. so how does that work in practice imagine
7:36
a system administrator suspects something is
7:38
wrong okay and they type a command to list all
7:41
the active processes and hidden files currently
7:44
running on a router okay standard troubleshooting
7:47
right the rootkit sees that command being issued
7:50
actively filters its own malicious files out
7:53
of the results, and hands a pristine, perfectly
7:55
clean list back to the administrator. Are you
7:58
kidding me? No. The operating system is actively
8:01
lying to the very people trying to defend it.
8:04
Wow. So if the attackers are utilizing these
8:07
ultra -expensive zero -day exploits to get into
8:09
the hypervisors, and then deploying rootkits
8:12
that actively lie to the system administrators,
8:15
I mean, finding them sounds hard enough. But
8:18
getting them out must be an entirely different
8:20
nightmare. It is an incredibly delicate operation.
8:22
Which explains the massive scale of the response
8:25
here. I mean, the Singapore government launched
8:27
what they called Operation Cyber Guardian. Yes,
8:29
Cyber Guardian. Based on the numbers from the
8:31
cybersecurity agency, this was Singapore's largest
8:35
cyber incident response effort to date. It's
8:38
a massive undertaking. This operation lasted
8:40
more than 11 months. Nearly a year of continuous
8:43
mitigation. And the duration alone that just
8:45
highlights the extreme complexity of rooting
8:48
out a hypervisor level threat. OK, wait, let
8:51
me challenge that timeline for a second. Sure.
8:53
11 months seems like an absolute eternity in
8:56
the tech world. I mean, if my laptop gets a severe
8:58
virus, I back up my photos, wipe the hard drive
9:02
completely clean, and reinstall the operating
9:05
system in like an afternoon. Right. Why does
9:08
it take over 100 government cyber experts almost
9:11
a year to clean up a network? Well, think about
9:14
the environment they are operating in. You are
9:16
trying to rebuild the foundation of a suspension
9:18
bridge while rush hour traffic is actively driving
9:21
over it. Oh, man. You cannot simply wipe the
9:24
hard drives of Singapore's four major telecommunications
9:27
providers. You can't turn off the Internet for
9:29
a nation. Because everything relies on it. Everything,
9:32
hospitals, financial clearinghouses, military
9:35
logistics, emergency services, they all rely
9:39
on continuous unbroken uptime. So they basically
9:42
have to surgically remove the root kits while
9:45
the data packets are... actively flowing. Exactly.
9:48
They have to identify the compromised nodes,
9:51
spin up entirely new, clean, patched virtual
9:54
environments that are parallel to the infected
9:56
ones. Then they have to seamlessly migrate the
9:58
live network traffic over to the clean nodes
10:01
without dropping a single connection. That sounds
10:03
impossible. And then on top of that, they have
10:05
to isolate and study the infected servers to
10:08
ensure the threat actor hasn't left, you know,
10:10
a secondary back door somewhere else. Right.
10:12
Because if you miss one. They're back in. Yeah.
10:14
So doing that across four massive telcos without
10:17
causing a latency spike is a monumental engineering
10:20
feat. And the fact that they pulled it off brings
10:23
up the most counterintuitive, surprising aspect
10:25
of this entire event, at least to me. What's
10:27
that? Despite the hackers gaining access to critical
10:30
systems and despite them maintaining this covert,
10:33
persistent presence for roughly a year, there
10:36
were absolutely zero service disruptions. None.
10:39
None at all. And that points to the discipline
10:41
of UNC 3886 for sure. But it also validates the
10:46
defense in depth mechanisms that the telcos possess.
10:48
OK, so the telcos had safeguards. Right. The
10:51
attackers were inside. But they were prevented
10:53
from gaining total unrestricted administrative
10:56
control over the entire core. But the strangest
10:59
part is the data itself. The missing data. Exactly.
11:03
The CSA explicitly reported that there was no
11:06
evidence to date that any sensitive customer
11:08
data or personal records were accessed or exfiltrated.
11:12
None. No credit cards were stolen. No personal
11:14
text messages were downloaded. No billing records
11:17
were dumped on the dark web for sale. Right.
11:19
Really analyze that for a second. They spend
11:21
millions of dollars. on zero days. They build
11:23
these invisible rooms in the hypervisors. They
11:25
sit quietly in the digital walls for a year.
11:28
And they don't steal a single credit card or
11:30
private text. What is the motive? I mean, why
11:34
expend all those resources just to sit there?
11:36
Well, this is where we really have to separate
11:38
our understanding of cybercrime from cyberespionage.
11:41
Okay, break that down. Cybercriminals, right,
11:43
they are motivated by immediate financial liquidity.
11:46
Cash. Exactly. They steal databases to sell on
11:50
dark web forums or they deploy ransomware to
11:53
extort cryptocurrency. Right. That's the loud
11:55
stuff we talked about. Exactly. Nation state
11:57
threat actors, though, they are playing a vastly
12:00
different, much longer game. OK. Their currency
12:04
is strategic intelligence and geopolitical advantage.
12:07
So in that context, telecommunications infrastructure
12:10
isn't just a company. No. It's the central nervous
12:14
system of a target nation. You nailed it. Telecommunications
12:17
infrastructure is the holy grail for a state
12:20
-backed intelligence apparatus. Why specifically
12:23
telecom? Because everything a modern society
12:25
requires to function flows through those specific
12:28
pipes. When a group like UNC386 infiltrates a
12:31
telco and deploys these silent route kits, their
12:34
primary goal is often mapping out the network
12:36
architecture. They just want the blueprints.
12:39
Right. They need to understand exactly how the
12:41
data flows, where the most critical administrative
12:43
nodes are located, and what the dependencies
12:45
are between different government and civilian
12:48
sectors. They're learning the layout of the building
12:50
so they know exactly which load -bearing walls
12:54
to hit in the future? Exactly. The term used
12:56
in the intelligence community is prepositioning.
12:59
Prepositioning. And according to the broader
13:01
context provided by Reuters and Mandiant, these
13:04
operations are frequently about preparing for
13:06
future geopolitical conflicts. Like what kind
13:08
of conflicts? Well, take the constantly analyzed
13:11
scenario of a potential future conflict over
13:14
Taiwan. Right. If a regional crisis erupts, having
13:18
deep, undetected, persistent access to the telecommunications
13:22
infrastructure of a major logistical and financial
13:25
hub like Singapore. I mean, that provides an
13:28
unbelievable strategic advantage. Huge. You don't
13:31
have to launch a new attack on day one of a conflict.
13:34
Because you've already been inside the network
13:35
for two years. You are already in the control.
13:37
room. You could monitor high -level government
13:40
communications. You could subtly disrupt maritime
13:43
logistics. Wow. Or even sever connectivity to
13:47
financial sectors at the precise moment it causes
13:49
the maximum amount of strategic paralysis. So
13:52
you basically plant the digital explosives years
13:55
in advance, simply waiting for a political directive
13:58
to detonate them. That's the theory. Yeah. And
14:00
again, we have to note that Beijing vehemently
14:03
denies engaging in this kind of prepositioning
14:05
or state sponsored espionage. Of course. But
14:08
from a purely theoretical military strategy standpoint,
14:11
that is exactly how a major global power would
14:14
leverage advanced cyber capabilities. Yeah, it's
14:17
about securing the high ground for tomorrow's
14:19
potential conflicts, completely ignoring today's
14:23
financial game. And the sheer discipline required
14:25
to secure that high ground. and then do absolutely
14:28
nothing with it. I mean, that is what makes UNC
14:30
3886 so formidable. They had access to critical
14:34
infrastructure, but they chose to merely observe.
14:36
To really emphasize how specific that discipline
14:39
is, I think it helps to contrast UNC 3886 with
14:43
other major cyber events dominating the headlines
14:46
recently. That's a good point. A great example
14:48
is the Salt Typhoon attack. Right, Salt Typhoon.
14:50
These were incredibly widespread breaches that
14:53
hit hundreds of telecom companies globally, including
14:56
major... carriers in the United States yeah and
14:58
multiple Western governments linked salt typhoon
15:01
to China as well right but the operational style
15:03
was entirely different extremely different the
15:06
difference in methodology is very revealing about
15:08
how these groups are organized actually oh so
15:10
well the Singapore government explicitly stated
15:14
in their public announcement that the attack
15:15
carried out by UNC 3886 on their local telcos
15:19
had not resulted in the same extent of damage
15:22
as cyber attacks elsewhere right specifically
15:25
referencing those global salt typhoon acts. Exactly.
15:27
Because salt typhoon was louder, it was aggressive,
15:30
and it resulted in far more tangible exposure.
15:34
But UNC -380 -A6 operated like a ghost. It proves
15:38
that advanced persistent threat groups, or APTs,
15:41
are not a single monolith. even if they are suspected
15:45
to originate from the exact same country. They're
15:47
compartmentalized. Yeah, they operate like highly
15:50
specialized military units with entirely different
15:53
objectives, different toolkits, and different
15:55
rules of engagement. One group might be tasked
15:58
with aggressive, loud data collection, sweeping
16:01
up as much raw intelligence as possible. Like
16:04
Soul Typhoon. Right. Another group, like UNC3886,
16:08
is tasked purely with maintaining a silent foothold
16:11
in critical infrastructure. at all costs. And
16:14
Singapore's infrastructure is clearly a high
16:16
priority target for these various groups. I mean,
16:19
our sources indicate Singapore has faced similar
16:22
sophisticated threats very recently. Oh, definitely.
16:25
Earlier in 2024, Bloomberg reported that another
16:28
major group known as Volt Typhoon was believed
16:31
to have breached Singtel. the country's largest
16:33
mobile carrier. Yeah, the typhoons. Right. You
16:36
have Volt Typhoon, Salt Typhoon, UNC3886. I mean,
16:39
these networks are under constant evolving siege.
16:42
They are. And as the telcos themselves stated
16:45
in their joint response, they regularly face
16:47
attacks and they are forced to constantly evolve
16:50
their defense in -depth mechanisms just to survive
16:53
the baseline threat environment. It's exhausting
16:55
just thinking about it. It really forces us to
16:58
view the modern Internet not as a secure public
17:00
utility, but as a highly contested battle space.
17:04
Where the most significant dangerous maneuvers
17:06
happen entirely out of public sight. Right. So
17:10
synthesizing everything we've looked at today,
17:12
you know, the CSA's detailed announcement, the
17:15
sheer technical wizardry of burning zero days
17:18
to access hypervisors. The root kits. The root
17:21
kits, the monumental 11 -month engineering feat
17:24
of Operation Cyber Guardian, and this really
17:27
chilling geopolitical strategy of propositioning.
17:30
Yeah. What is the core lesson for the people
17:33
and organizations relying on these networks every
17:35
day? I think the core lesson is a fundamental
17:38
shift in how we define a secure environment.
17:41
Okay, tell me more about that. Historically,
17:43
we sort of assumed that a quiet network was a
17:46
secure network. If the alarms weren't sounding,
17:48
we were safe. Right. No news is good news. Exactly.
17:51
But UNC -3886 proved definitively that the absence
17:55
of alarms does not mean the absence of an intruder.
17:57
Wow. The most dangerous cyber threats operating
18:00
today aren't the ones that break your servers
18:02
or lock your files and demand a ransom in cryptocurrency.
18:05
The truly existential threats are the ones that
18:08
are perfectly content to sit quietly in the shadows
18:11
of the infrastructure you rely on, methodically
18:14
mapping your vulnerabilities, just watching and
18:17
waiting. That is an incredibly unsettling reality
18:20
to leave you with. If it takes over 100 dedicated
18:23
government cyber defenders nearly an entire year
18:26
of painstaking surgical work to clean up a silent
18:29
threat that never even tripped a standard alarm
18:31
or stole a single file. Yeah. What else might
18:34
be lurking in the digital pipes we use to communicate
18:36
right this second? Are we absolutely sure the
18:39
hidden room in the ventilation shaft is actually
18:41
empty? It's a question we all need to be asking.
18:44
Thank you so much for exploring this complex
18:45
landscape with us today. Understanding the stark
18:47
realities of these silent sieges is the absolute
18:50
first step in defending against them. To make
18:52
sure your own digital infrastructure is secure
18:54
and to discuss your security and IT needs, be
18:57
sure to visit www .kinsoft .com .au. Keep asking
19:02
questions, keep looking past the obvious, and
19:05
we will catch you next time.