Singapore's Cyber Security Agency attributed a sophisticated espionage campaign against all four major telcos — M1, SIMBA, Singtel and StarHub — to the China-nexus group UNC3886. Active since around July 2025, the attackers exploited Fortinet and VMware zero-days plus advanced Linux rootkits to hold persistent access for close to a year before being evicted. The response, Operation Cyber Guardian, ran more than eleven months with 100+ defenders. Officials found no evidence that customer personal data was exfiltrated and services were not disrupted — the goal was intelligence-gathering on critical infrastructure.

Want to understand whether your network has uninvited long-term guests? Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: TechCrunch; The Record (Recorded Future News).