No idle punt: Why Singapore called out cyber saboteur UNC3886 by name

Singapore's naming of cyber threat group signals to state actors that their infiltration is known and is being countered.

- Bhavan Jaipragas

When the Government revealed that the country's critical infrastructure was under attack from cyber threat group UNC3886, Singaporeans responded by snapping up those 4-D betting numbers. From a glass-half-full perspective, this, at least, showed that the message was heard.

This was "peak Singapore" behaviour, as one commentator put it on X.

Even Coordinating Minister for National Security and Minister for Home Affairs K. Shanmugam noted this trend following his widely reported July 18 speech on the "advanced persistent threats" posed by UNC3886.

A day after his warning — which global media outlets picked up — he highlighted on Facebook how the number 3886 had quickly sold out on Singapore Pools for both big and small bets.

He wrote: "I said Singaporeans need to know that UNC3886 is attacking us in cyberspace. And that it's very serious. One reaction: No. 3886 has been sold out for 4-D today."

There was a hint of wryness, perhaps, but surely, better this than the message falling on deaf ears.

The light-hearted response aside, Mr Shanmugam's revelation has opened up several critical debates — not least whether UNC3886 is, in fact, China-linked. The minister named UNC3886 but did not identify the state actor behind it, though Mandiant — a highly reputable cyber-security firm and part of Google — labels the entity a "China nexus espionage group".

Some, who regard China as intrinsically benign, dismiss this label as Western geopolitical spin. But Singaporeans should recognise Mandiant's established credibility in global cyber security. Beijing's denials — including a statement from its embassy in Singapore after Mr Shanmugam's speech — alone are not sufficient to brush these claims aside.

THE 'WHY' AND 'HOW'

However, even setting aside attribution, a bigger question looms: Why Singapore?