Critical infrastructure in Singapore under attack by cyber espionage group

Cyber security agency and relevant bodies actively dealing with threat: Shanmugam

- Samuel Devaraj

The authorities are dealing with an ongoing attack on Singapore's critical information infrastructure by a state-sponsored cyber espionage group, UNC3886.

Naming the nation's attacker for the first time on July 18, Coordinating Minister for National Security K. Shanmugam said that Singapore is facing serious threats from state-linked advanced persistent threat (APT) actors.

These are well-resourced attackers that use sophisticated techniques to evade detection. They lurk in networks to spy over the long term, to steal sensitive information or disrupt essential services, among other objectives.

"UNC3886 poses a serious threat to us, and has the potential to undermine our national security," said Mr Shanmugam at the Cyber Security Agency of Singapore's (CSA) 10th anniversary dinner at Sands Expo and Convention Centre.

"Even as we speak, UNC3886 is attacking our critical infrastructure right now."

Mr Shanmugam, who is also Home Affairs Minister, did not disclose UNC3886's sponsors, but experts have said that the group is linked to China.

Cyber-security firm Mandiant first detected the Chinese espionage group in 2022. UNC3886 is said to have targeted prominent strategic organisations - including those in the defence, technology and telecommunication sectors - on a global scale.

APT hackers like UNC3886 gain unauthorised access into networks by employing techniques such as custom malware and tools available on the victim's system to evade detection. Zero-day exploits, which are unpatched vulnerabilities, are also typically used to gain entry to networks.

Mr Shanmugam said CSA and relevant agencies are actively dealing with the attack, and are working with relevant critical information infrastructure owners.