Singapore vs. UNC3886: eleven months to evict an intruder from four telcos

Background

Most security tooling watches laptops, servers and the applications running on them. It generally doesn't watch the hypervisors underneath those servers, or the routers and firewalls carrying traffic between them — not because that layer is unimportant, but because conventional endpoint software simply has nothing to install there. UNC3886, a cyber-espionage group Google's Mandiant has tracked since 2022, has built its entire practice around that gap: compromising VMware hypervisors, Fortinet appliances, and routers from Juniper and Cisco, then operating from inside infrastructure that was never designed to report on itself.

Eleven months, four telcos, one quiet entry point

What actually happened

Singapore's Cyber Security Agency (CSA) has described the entry point only as "a previously unknown flaw" used to get past the perimeter — the vulnerability itself has never been publicly named. What came next matched UNC3886's reputation: rather than reaching for data immediately, the group settled into the hypervisor and network-appliance layer, installing two custom rootkits. REPTILE, running in the kernel, concealed its processes, files and network connections while keeping a reverse shell open. MEDUSA logged credentials and ran commands through its own SSH server. Both were planted as systemd units and startup scripts — built to survive a reboot, not to grab what they could and leave.

All four of Singapore's major telecom operators — M1, SIMBA Telecom, Singtel and StarHub — had parts of their networks compromised, with the intrusion reaching limited portions of critical systems at at least one of them. Singapore chose not to wait for a finished story before saying anything: on July 18, 2025, with UNC3886 still active inside the networks, Minister K Shanmugam told reporters the group was attacking critical infrastructure "at that very moment." He named the threat actor. He did not name a country, calling that attribution "speculative" at the time.

Closing the intrusion out took considerably longer than disclosing it. Operation CYBER GUARDIAN ran for more than eleven months, drawing over 100 personnel from six government agencies who worked inside the telcos directly — tracing every path the group had used to move laterally, shutting each one, and building monitoring capable of catching a repeat attempt. CSA and Singapore's infocomm regulator, IMDA, went public with the full findings on February 9, 2026.

Their conclusion was specific rather than reassuring-sounding: no evidence of customer data theft, and no disruption to telecom service, at any point across the entire operation.

Root cause

Timeline

Detection

What to monitor for in your own environment

Containment, eradication & recovery

Security control analysis

Controls that would have prevented or limited this

Blast radius

Full compromise, zero confirmed data theft

What they got right

Singapore spoke publicly in July 2025 with the intrusion still underway, rather than holding the announcement until the story had a tidy ending. Eleven months of silence about an active compromise of national telecom infrastructure was not treated as an acceptable default.

Six separate government agencies worked as one operation rather than six parallel ones. Pulling together over 100 people under a single name — Operation CYBER GUARDIAN — meant the telcos dealt with one coordinated response, not six overlapping ones.

The closing statement named exactly two things and stopped: no customer data theft, no service disruption. Officials didn't round that up to "minimal impact" or round it down to silence — they said what they could actually stand behind.

Why this keeps happening

UNC3886 doesn't target hypervisors and network appliances because those systems are newly fragile. It targets them because conventional endpoint security was never built to watch that layer at all — a structural blind spot shared by most organizations, not a mistake specific to Singapore's telcos.

Lateral movement here relied on stolen, valid credentials rather than fresh exploits at every step. Activity carried out with real logins doesn't look like an intrusion to most detection built around unauthorized access — it looks like an administrator doing their job, which is exactly why a campaign like this can run for months unnoticed.

Governments routinely hold more confidence about attribution in private than they're willing to state in public. Singapore's restraint on naming a country fits a pattern seen across nation-state-linked incidents generally — diplomatic and evidentiary thresholds for a public statement sit well above the threshold needed to run an effective eviction.

Lessons for your own environment

1. Your blind spot is wherever your EDR doesn't reach

   UNC3886 lives in hypervisors and network appliances specifically because endpoint tools don't run there. If monitoring stops at the OS layer, that gap is exactly what this kind of intrusion is built to use.

2. A rootkit built to survive reboot needs a rebuild, not a cleanup

   REPTILE and MEDUSA were installed as systemd units and startup scripts specifically so they'd persist. Treat a sophisticated implant like this as a reason to rebuild the environment, not a file to delete.

3. Stolen credentials make an intrusion look like routine access

   UNC3886's lateral movement ran on valid, stolen logins. Detection aimed only at unauthorized access misses this entirely — you need monitoring built around anomalous use of legitimate access, not just unauthorized entry.

4. Disclose while it's still live if waiting means staying silent for months

   Singapore went public while UNC3886 was still inside the networks. The alternative was eleven-plus months with no public word about an active intrusion into infrastructure the public depends on.

5. Build the cross-agency relationships before the incident, not during it

   Operation CYBER GUARDIAN coordinated 100+ people across six agencies smoothly because those working relationships already existed. A crisis is the wrong time to be introducing your incident response team to each other.

6. A government's silence on attribution is often a choice, not a gap

   Singapore named the threat actor with confidence but declined to name a state. Don't read restraint on that specific point as uncertainty about the underlying investigation — they're frequently different things.

CISO & board lessons

• If your organization operates or depends on critical infrastructure, ask directly whether your security monitoring extends past the OS layer into hypervisors and network appliances — not whether a vendor claims coverage there, but whether anyone could actually point to a specific detection built for that layer.
• Budget conversations about EDR coverage usually stop at the endpoint. This incident is a concrete example of why that's an incomplete budget line for any organization running virtualized infrastructure or managing its own network appliances at scale.
• A board should understand the difference between high confidence in a threat actor's identity and a formal government attribution to a state — conflating the two creates a claim the organization may not be able to defend later, and Singapore's own public statements are a model for how to hold that line explicitly.
• Eleven months is a realistic timeline for fully evicting a sophisticated, infrastructure-level intrusion, not an outlier to plan around as unlikely. Budget and staff accordingly if your threat model includes an actor capable of this kind of persistence.
• The relationships that made Operation CYBER GUARDIAN work — six agencies operating as one — existed before the incident. A board should ask whether the organization's own cross-functional incident response relationships (security, legal, communications, leadership) have ever actually been tested, not assumed.

Action plan

Could this happen in your organization?

• Could you name, specifically, what is monitoring your hypervisors and network appliances — or does your security coverage effectively stop at the operating system layer?
• Would your detection tooling flag an administrator-looking login using valid, stolen credentials as anything unusual at all?
• If you discovered today that an intruder had been present in your infrastructure for nearly a year, does your incident response plan actually account for a dwell time that long?
• Do your security, legal, communications and leadership teams have a tested working relationship before an incident, or would a crisis be the first time they coordinated directly?
• Could your organization distinguish, publicly and precisely, between high confidence in a threat actor's identity and a formal attribution to a specific government — and would your spokespeople know not to conflate the two?
• If you operate infrastructure other organizations depend on, do you have a standard for when to disclose an active, unresolved intrusion rather than waiting until it's fully closed out?

If this happened to you: what to ask, and what to say

Knowing the lesson isn’t the same as knowing what to do with it Monday morning. A security lead, a CISO, and a customer-facing team each need something different from this incident.