Reporting advanced suspected cyber attacks will provide a defence framework: Shanmugam

Straits Times

6 days ago

Sign up now: Get ST's newsletters delivered to your inbox
(Seated, from left) Minister for Digital Development and Information Josephine Teo and Coordinating Minister for National Security K. Shanmugam touring the exhibits at the Exercise Cyber Star on Aug 1.
SINGAPORE - Mandating that operators of critical systems, such as those that manage energy, water and transportation services, report suspected advanced attacks will provide the necessary framework for Singapore to defend itself, said Coordinating Minister for National Security K. Shanmugam on Aug 1.
Declining to name the country behind the recent advanced persistent threat (APT) attack on Singapore, he urged organisations to have the mentality that there are and will be breaches.
'Accept that, and be prepared to defend,' he said, speaking on the sidelines of a biennial cybersecurity exercise, called Exercise Cyber Star, organised by the Cyber Security Agency of Singapore.
'Tell us immediately the moment you suspect (something). We work with you to try and deal with it,' he added.
Mr Shanmugam's comments came after the authorities revealed in July that Singapore's critical information infrastructure (CII) came under attack from
UNC3886, a state-linked advanced persistent threat actor.
UNC3886 is one of several APT actors, whose activities have increased more than fourfold from 2021 to 2024, that target Singapore's CII.
In light of increased threats, Singapore has also amended its Cybersecurity Act in 2024 to require CII operators to declare any cyber-security outage, and any attack on their premises or along their supply chain.
Top stories
Swipe. Select. Stay informed.
World Trump modifies reciprocal tariffs ahead of deadline; rate on Singapore likely to remain at 10%
Business Singapore's US tariff rate stays at 10%, but the Republic is not out of the woods yet
Singapore NUS launches S'pore's first nursing practice doctorate to meet evolving healthcare needs
Singapore Data breach involving 147,000 Cycle & Carriage Singapore customer records under probe
Business CAD probing Tokenize Xchange operator; firm's director charged with fraudulent trading
Singapore PM Wong to deliver National Day message on Aug 8
Singapore Man charged over kicking woman's face in Teck Whye Lane flat, leading to her death
In particular, operators of critical systems must report suspected APT attacks to CSA, whose oversight will expand to include risks that come from suppliers and cloud services. The amendments are expected to kick in later in 2025.
Declining to name the country behind UNC3886, Mr Shanmugum said: 'We release information that we assess is in the public interest...Naming a specific country is not in our interest at this point of time.'
Experts have said that the group is linked to China.
On naming the group, he added: 'In this case, we felt that the situation and the threat of the attack and compromise was serious enough, and we were confident enough to name UNC3886.'
In a statement on July 19 responding to media reports about UNC3886 being linked to Beijing, a spokesperson for the Chinese Embassy in Singapore said: 'China expresses strong dissatisfaction with this, and we resolutely oppose any unwarranted smearing against China.
'In fact, China is one of the main victims of cyber attacks. We reiterate that China resolutely opposes and combats any form of cyber attacks in accordance with the law, and will not encourage, support or condone hacker attacks.'
On Aug 1, Mr Shanmugam also spoke about the need for cybersecurity exercises to be better prepared for attacks, which is why Exercise Cyber Star is important.
The exercise is in its sixth edition, and is the largest to date. It was held over a period of 11 days and involved nearly 500 participants from CSA, owners from Singapore's 11 critical sectors, and the Singapore Armed Forces' Digital and Intelligence Service.
At the event, CII operators were tested on their skills in countering simulated cyber attacks such as those from APT actors. CII operators were also tested on their ability to deal with spillover effects from the attacks that affect the larger business community and society.
'This exercise brings together the different sector leads, critical infrastructure owners...to exercise real-life scenarios,' said Mr Shanmugam.
'Imagine millions of people travelling on our subways, and something goes wrong... What's your approach on dealing with the attack? How do you recover from it?' he said, noting that the private sector also needs to have the know-how to better work with the government to contain the damages.
Singapore's 11 CII sectors are aviation, healthcare, land transport, maritime, media, security and emergency services, water, banking and finance, energy, infocomm and government.
UNC3886 is not the first APT attack on Singapore - there was a security breach in the Ministry of Foreign Affairs' technology systems back in 2014, and intrusions in the networks of two local universities in 2017 believed to be aimed at stealing government and research data.
The Republic experienced its worst data breach in 2018, which involved the personal particulars of 1.5 million patients including former Prime Minister Lee Hsien Loong.
The attacker in this breach on SingHealth was said to have been persistent in its efforts to access the electronic medical records system, and is believed to have lurked in the healthcare group's network for at least nine months.