Critical infrastructure in S'pore under attack by cyber espionage group: Shanmugam

Straits Times

18-07-2025

Find out what's new on ST website and app.
UNC3886 is said to have targeted prominent strategic organisations on a global scale.
SINGAPORE - The authorities are dealing with an ongoing attack on Singapore's critical information infrastructure by a state-sponsored cyber espionage group UNC3886.
Naming the nation's attacker for the first time on July 18, Coordinating Minister for National Security K. Shanmugam said that Singapore is facing serious threats from state-linked advanced persistent threat (APT) actors.
These are well-resourced attackers that use sophisticated techniques to evade detection. They lurk in networks to spy over the long term to steal sensitive information or disrupt essential services, among other objectives.
'UNC3886 poses a serious threat to us, and has the potential to undermine our national security,' said Mr Shanmugam at the Cyber Security Agency of Singapore's (CSA) 10th anniversary dinner at Sands Expo and Convention Centre.
'Even as we speak, UNC3886 is attacking our critical infrastructure right now.'
Mr Shanmugam did not disclose UNC3886's sponsors, but experts have said that the group is linked to China.
Cybersecurity firm Mandiant first detected the Chinese espionage group in 2022. UNC3886 is said to have targeted prominent strategic organisations - including those in the defence, technology and telecommunication sectors - on a global scale.
Top stories
Swipe. Select. Stay informed.
Singapore Who is UNC3886, the group that attacked S'pore's critical information infrastructure?
Singapore HSA looking to get anti-vape cyber surveillance tool with AI capabilities
Singapore Alleged Kpod peddler filmed trying to flee raid in Bishan charged with 6 offences
Singapore NTU upholds zero grade for student who used AI in essay; panel found 14 false citations or data
Singapore 30% of aviation jobs could be redesigned due to AI, automation; $200m fund to support workers: CAAS
Singapore Former NUH male nurse faces charges after he allegedly molested man at hospital
Singapore Character counts as much as grades, Desmond Lee tells students
APT hackers like UNC3886 gain unauthorised access into networks by employing techniques such as custom malware and tools available on the victim's system to evade detection. Zero-day exploits, which are unpatched vulnerabilities, are also typically used to gain entry to networks.
Mr Shanmugam said CSA and relevant agencies are actively dealing with the attack, and are working with critical information infrastructure owners.
Describing UNC3886 as highly sophisticated and persistent in victim networks, he said: 'The intent of this threat actor is clear. They are going after high value and strategic targets.'
If successful, APT attacks could cause a disruption to electricity supply, which could have a knock-on effect on other essential services such as healthcare or transport.
Mr Shanmugam said the number of suspected APT attacks in Singapore has increased more than four-fold from 2021 to 2024.
'There are also economic implications. Our banks, airport, and industries would not be able to operate. Our economy can be substantially impacted,' he said.
He cited APT attacks in Ukraine that caused a power outage. He also cited a cyber-attack on a South Korean telecommunications company in April 2025 that exposed the SIM data of nearly 27 million users and caused widespread concern in the country.
'Singapore has been attacked as well. We are a relevant country geopolitically. We are a digital and data hub that connects the world,' he said. 'People want to get into our systems, to both influence us and threaten us.'
He highlighted some attacks from APT actors in Singapore that have been made public, but where the culprits were not named due to national security reasons.
These include an incident in 2014, when the authorities detected a security breach in the Ministry of Foreign Affairs' technology systems. Steps were taken to isolate the affected devices and the networks were strengthened following the discovery.
In what was the first sophisticated attack against universities here, National University of Singapore and the Nanyang Technological University discovered intrusions in their networks in 2017.
No classified data or student personal data was stolen. But the attackers were believed to have targeted the two institutions to steal government and research data. The varsities were involved in government-linked projects for the defence, foreign affairs and transport sectors.
Then in 2018, Singapore experienced its worst data breach
involving the personal particulars of 1.5 million patients , including then Prime Minister Lee Hsien Loong.
The attacker in the SingHealth breach was said to be persistent in its efforts to penetrate the network, bypass the security measures and illegally access and exfiltrate data.
The attacker is believed to have lurked in the healthcare group's network for at least nine months. Its mission: to access SingHealth's electronic medical records system, a critical information infrastructure in Singapore. The unauthorised transfer of sensitive data took place in 2018.
Most recently in 2024, about 2,700 devices in Singapore were discovered to have been infected after CSA took part in a cyber operation against a global botnet.
APT hackers behind the botnet exploited poor cyber hygiene practices to infect devices, including baby monitors and internet routers. No critical information infrastructure was affected by the attack.