Edge Devices In Singapore Telecom Networks Targeted By Chinese Hackers

Singapore’s telecom networks faced a major cyber threat from Chinese hackers known as UNC3886, an advanced persistent threat (APT) group.

This state-linked actor launched a targeted campaign against all four major telcos M1, SIMBA Telecom, Singtel, and StarHub focusing on edge devices like routers and firewalls at network borders.

First flagged publicly on July 18, 2025, by Coordinating Minister for National Security K Shanmugam, the attacks used cutting-edge tools to sneak in and stay hidden.

Singapore’s Telcos Hit By Sophisticated Attacks

APTs like UNC3886 are elite hackers who probe defenses patiently with high-tech tricks.

They aimed at edge devices, the “front doors” of telecom networks that handle internet traffic and connect core systems. In one key breach, hackers exploited a zero-day vulnerability a previously unknown flaw in a perimeter firewall.

This let them slip past edge protections into telco networks, stealing small amounts of technical data, mostly network maps, to aid further attacks.

Edge devices are prime targets because they sit exposed online, managing data flows for millions. Telecoms rely on them for routing calls, internet, and 5G signals. Once inside, UNC3886 deployed rootkits—malicious software that hides itself deep in device operating systems.

Rootkits rewrite system files, block antivirus scans, and erase logs, making detection tough. Defenders had to scour entire networks with forensic tools, checking device configs, logs, and traffic patterns for signs of compromise.

No customer data, such as names or phone records, was touched, and services remained online. But the breach showed how edge devices can become beachheads for deeper hacks, risking outages or spying on national traffic.

Operation CYBER GUARDIAN Fights Back

Telcos spotted odd activity first and alerted regulators: the Cyber Security Agency (CSA) and Infocomm Media Development Authority (IMDA).

This sparked Operation CYBER GUARDIAN, Singapore’s largest-ever cyber response.

Over 11 months, more than 100 experts from CSA, IMDA, the Centre for Strategic Infocomm Technologies (CSIT), the Digital and Intelligence Service (DIS), GovTech, and the Internal Security Department (ISD) worked with telcos.

The goal: contain hackers, patch holes, and boost defenses. They mapped UNC3886’s paths through edge devices, revoked stolen credentials, and rolled out fixes.

Tactics included isolating infected routers, running joint threat hunts (proactive scans for hidden foes), and penetration tests (simulated attacks to find weak spots).

Monitoring expanded with AI-driven tools that watch edge traffic in real time for anomalies, such as unusual data outflows.

Success metrics: Hackers gained limited access to some critical systems but couldn’t disrupt services or steal personal information.

Remediation closed entry points, and telcos upgraded edge firmware, multi-factor authentication, and zero-trust models where no device fully trusts another without checks.

This public-private teamwork mirrors Singapore’s cyber doctrine: shared roles, rapid response, and ecosystem-wide training.

Minister Josephine Teo praised defenders at a recent event, urging infrastructure owners to “upgrade systems and skills” to counter threats like UNC3886.

Telcos power Singapore’s digital economy, carrying sensitive flows a full breach could cripple security or the economy.

UNC3886 may try again, so CSA and IMDA push active defenses: threat intel sharing, capability drills, and ecosystem initiatives telcos now run regular hunts and tests.

The fight continues as Minister Teo said, actions at the frontline decide if nations win or lose against sophisticated foes.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Edge Devices In Singapore Telecom Networks Targeted By Chinese Hackers appeared first on Cyber Security News.