China-linked APT UNC3886 targets Singapore telcos
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41328 | Path Traversal in Fortinet FortiOS Exploited in Targeted Attacks CVE-2022-41328 is a path traversal flaw (CWE-22) in Fortinet FortiOS in which the system fails to properly limit file paths, allowing crafted CLI commands to escape the restricted directory. A privileged attacker — one who already has CLI access to the device — can issue these crafted commands to read and write arbitrary files on the underlying Linux system, effectively breaking out of the FortiOS CLI sandbox. That post-compromise capability is valuable for stealth and persistence, since changes to system files on the underlying OS may not be visible through normal FortiOS administration. Organizations running FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, or any release before 6.4.11 are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-14, carries a high EPSS score (10.7% probability of exploitation within 30 days, 96th percentile), and public reporting describes its use in targeted cyberattacks on government entities attributed to the espionage group tracked as UNC3886, though no public proof-of-concept code is known. Do: Upgrade all affected FortiGate/FortiOS devices to a fixed release beyond the affected ranges — 7.2.4 or later, 7.0.10 or later, or 6.4.11 or later — per Fortinet's advisory, as required by the CISA KEV entry. Restrict privileged CLI access (admin accounts, trusted-host/local-in policies) and review CLI logs plus the underlying Linux filesystem for unexpected file changes as signs of compromise, particularly on government or otherwise high-value networks given UNC3886 targeting. | 7.1 | 11% | KEV |
| masshundreds of thousands of FortiGate deployments (well over 100,000 internet-facing FortiGates appear in public scans) |
Full article620 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 10, 2026
China-linked group UNC3886 targeted Singapore ’s telecom sector in a cyber espionage campaign, Singapore’s Cyber Security Agency revealed.
Cyber Security Agency of Singapore (CSA) and the Infocomm Media Development Authority (IMDA) ran Operation CYBER GUARDIAN to protect the telecom sector. Since July 2025, investigations showed China-linked UNC3886 launched a targeted campaign against all four major telcos: M1, SIMBA Telecom, Singtel, and StarHub, aiming at critical infrastructure with deliberate and well-planned attacks.
UNC3886 is a sophisticated China-linked cyber espionage group that targets network devices and virtualization technologies using zero-day exploits. Its primary focus is on defense, technology, and telecommunications sectors in the US and Asia.
In 2023, the APT group targeted multiple government organizations using the Fortinet zero-day CVE-2022-41328 to deploy custom backdoors. UNC3886 prioritizes stealth by using passive backdoors and tampering with logs and forensic artifacts to ensure long-term persistence while evading detection.
“On 18 July 2025, Coordinating Minister for National Security Mr K Shanmugam shared that Advanced Persistent Threat (APT) actor UNC3886 had been detected attacking our critical infrastructure.” reads the report published by CSA. “Over the past months, our investigations have indicated that UNC3886 had launched a deliberate, targeted, and well-planned campaign against Singapore’s telecommunications sector. All four of Singapore’s major telecommunications operators (“telcos”) – M1, SIMBA Telecom, Singtel and StarHub – have been the target of attacks.”
UNC3886, a highly skilled APT group, targeted Singapore’s telcos using advanced methods over time. They exploited a zero-day to bypass a firewall and access networks, exfiltrating mainly network-related data. They also deployed rootkits to maintain persistent access, hide their activities, and evade detection, forcing cyber teams to perform thorough checks across all affected networks.
Singapore’s telcos spotted a breach by UNC3886 and promptly notified the IMDA and CSA. This started Operation CYBER GUARDIAN, Singapore’s biggest coordinated cyber response, lasting over 11 months.
“Under Operation CYBER GUARDIAN, the authorities worked closely with the telcos to limit UNC3886’s movement into the networks and ensure our systems remain safe to use. So far, the attack by UNC3886 has not resulted in the same extent of damage as cyberattacks elsewhere.” continues the report. “The threat actor was able to gain unauthorised access into some parts of telco networks and systems. In one instance, they were able to gain limited access to critical systems but did not get far enough to have been able to disrupt services.”
More than 100 cyber experts from different agencies worked with the telcos to stop the attackers, limit their access, and secure systems. The attackers gained only partial access, without stealing data or disrupting services. Authorities fixed weaknesses, blocked access points, and increased monitoring. This teamwork between the government and telcos shows Singapore’s strong national cyber defence.
The fight isn’t over. Even though efforts so far have contained the attacks, future attempts to breach telco systems remain possible. Telcos are key targets, handling vast data and supporting the digital economy, making successful attacks a threat to national security and the economy.
The government takes this seriously. CSA and IMDA are working with telcos to strengthen defences, improve detection, and monitor for UNC3886. Telcos are conducting joint threat hunting, penetration testing, and capability upgrades. CSA will also roll out initiatives to boost skills across the cyber ecosystem for faster, stronger responses.
Minister Josephine Teo thanked cyber defenders for their work in Operation CYBER GUARDIAN and urged continued vigilance.
“Your actions, or inaction, can determine whether we succeed or fail in protecting our critical infrastructure, and our national security.” said Minister Josephine Teo. “I urge all of you to continue investing in upgrading your systems as well as your capabilities.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, China)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/187792/apt/china-linked-apt-unc3886-targets-singapore-telcos.html