Singapore says China-backed hackers targeted its four largest phone companies | TechCrunch

"Singapore's government has blamed a known Chinese cyber-espionage group for targeting four of its top telecommunication companies as part of a months-long attack. In a statement Monday, Singapore confirmed for the first time that the hackers, known as UNC3886, targeted the country's telecoms infrastructure, including its largest companies: Singtel, StarHub, M1, and Simba Telecom. The government previously said that it was responding to an unspecified attack on its critical infrastructure."

"Google-owned cybersecurity unit Mandiant previously linked UNC3886 as an espionage group likely working on behalf of China. The Chinese government is known to conduct regular cyber-espionage operations, as well as prepositioning for disruptive attacks ahead of an anticipated invasion of Taiwan, which Beijing has routinely denied, per Reuters."

"UNC3886 is known for exploiting zero-day vulnerabilities in routers, firewalls, and virtualized environments, where cybersecurity tools that are designed to spot malware cannot typically reach. The hacking group has targeted the defense, technology, and telecom industries across the U.S. and the Asia-Pacific region. In the case of the attack on Singapore's top telcos, Shanmugam said the hackers used advanced tools, like rootkits, to gain long-term persistence to their systems."

A China-linked hacking group identified as UNC3886 targeted Singapore's top telecommunications firms Singtel, StarHub, M1, and Simba Telecom in a months-long intrusion. Intruders breached and accessed some systems but did not disrupt services or obtain personal information, according to government statements. UNC3886 exploits zero-day flaws in routers, firewalls, and virtualized environments and has targeted defense, technology, and telecom sectors across the U.S. and Asia-Pacific. The group used advanced tools, including rootkits, to maintain long-term persistence. Telcos reported routine DDoS and malware threats and stated they use defence-in-depth and prompt remediation.

Read at TechCrunch