FREEPIK.COM
Taiwan’s National Security Bureau said China’s cyber army has long been engaging in cyberattacks against Taiwan’s critical infrastructure
By Walter Wong
Singapore’s four major telcos in July 2025 were targeted by cyberespionage group UNC3886 allegedly linked to China’s cyber army.
Josephine Teo, Minister for Digital Development and Information, made the announcement at the Operation Cyber Guardian Engagement Event for Cyber Defenders on Feb 9.
“All four of our major telcos – Singtel, StarHub, M1 and Simba – have been targets of attacks,” she said.
“Attacks by UNC3886 were a deliberate, targeted and well-planned campaign against our telecommunications sector,” Teo added.
UNC3886 managed to gain access to some parts of their networks and systems, but “did not get far enough to have been able to disrupt services”, according to the Cyber Security Agency of Singapore (CSA).
CSA also found no evidence that UNC3886 had accessed or stolen sensitive customer data.
Remediation measures have since been implemented, such as closing off UNC3886’s access points and expanding the telcos’ monitoring capabilities.
“We have been working on this and practising our plans (regarding cyber defence) for several years, but this is the first time we have implemented the plan in an actual operation,” said Teo.
Following the attack, CSA launched the nation’s largest multi-agency cyber operation, code-named Operation Cyber Guardian, involving CSA, Infocomm Media Development Authority (IMDA) and other government agencies.
CNA reported in July that Coordinating Minister for National Security K Shanmugam declined to comment on the alleged link of UNC3886 to China.
"Who they are linked to and how they operate is not something I want to go into," he said, according to the report.
The Chinese Embassy in Singapore denied its link to UNC3886 in a statement posted on Facebook.
"The embassy would like to reiterate that China is firmly against and cracks down (on) all forms of cyberattacks in accordance with law.
China does not encourage, support or condone hacking activities," the report added.
Links with ‘China’s Cyber Army’: NSB
While Teo did not say at the event if UNC3886 is linked to China, Taiwan’s National Security Bureau (NSB) said UNC3886 is linked to China’s cyber army and is one of the top Chinese cyber hacker groups on the island.
“China’s cyber army has long been engaging in cyberattacks against Taiwan’s critical infrastructure (CI) by employing diverse and evolving tactics,” said NSB in a report released on Jan 4.
“BlackTech (黑科技), Flax Typhoon (亞麻颱風), Mustang Panda (野馬熊貓), APT41 and UNC3886 launched cyber operations against Taiwan’s CI focusing on five primary sectors, including energy, healthcare, communications and transmission, administration and agencies, as well as technology,” the report added.
It also reported that China’s cyber army launched 2.63 million intrusion attempts per day in 2025 targeting Taiwan’s critical infrastructure, marking a 6% increase over 2024.
The Chinese Communist Party (CCP) claimed Taiwan as its own territory although the island has had a democratically elected government since it first held presidential elections in 1996.
Chinese leader Xi Jinping has instructed the Chinese army, People’s Liberation Army (PLA), to be ready to invade Taiwan by 2027, according to US intelligence.
Other countries have been subjected to GNC3886 cyber attacks.
“The threat actor has targeted organisations in the government, telecoms, technology, aerospace, defence and utilities sectors in North America, Southeast Asia and Oceania, with other targets in Europe, Africa and elsewhere in Asia,” according to Kaspersky ICS CERT cybersecurity expert.
In a blog post on Mar 12 last year, Mandiant, a Google subsidiary known for outing Chinese hackers, noted that GNC3886 focuses on military, tech and communication enterprises in the US and Asia.
It described UNC3886 as “highly adept”, with a modus operandi that includes acquiring “legitimate credentials” and using them to operate undetected.
It also said the group has targeted network devices and virtualisation technologies with “zero-day exploits”, cyber attacks that take advantage of previously unknown vulnerabilities in software, hardware or firmware before vendors have a chance to patch them.
Teo said UNC3886 used “advanced techniques to cover their tracks and evade detection”.
NSB confirmed the sophistication of the techniques, attributing it to the “fully integrated military, intelligence, industrial and technological capabilities across both public and private sectors” to enhance the depth of intrusion and operational stealth of cyber attacks.
Teo also warned that “around the world, state-linked threat actors have stepped up their activities”.
She cited that US authorities reported that an Advanced Persistent Threat (APT) actor known as Volt Typhoon had infiltrated US critical infrastructure.
“They were found not just in one sector but several,” she said. “These include the energy, water, transportation and telecommunications sectors.”
The US cybersecurity agency confirmed Volt Typhoon as a CCP-sponsored cyber hacking group.
“The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA) and Federal Bureau of Investigation (FBI) assess that People’s Republic of China (PRC) state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against US critical infrastructure in the event of a major crisis or conflict with the United States,” CISA stated in a report in 2024.
Comments