Singapore Responds To ‘Highly Sophisticated’ Cyberattack As China Denies Involvement

Cybersecurity firm Mandiant, a Google-owned entity, has identified the group behind the attack as UNC3886 and described it as a “China-nexus espionage group”, local reports said.

The extent of the attack and its potential implications were first revealed on Friday by Coordinating Minister for National Security K Shanmugam.

Source : Freepik

Singapore’s defence and cyber agencies are actively countering a major cyber threat that has targeted its critical infrastructure, a situation which authorities say involves a China-linked espionage group. The Chinese Embassy in Singapore, however, has rejected the allegation as unfounded.

According to a report by Channel News Asia, cybersecurity firm Mandiant — a Google-owned entity — has identified the group behind the attack as UNC3886. The firm described it as a “China-nexus espionage group” known for targeting high-value strategic institutions worldwide, reported PTI.

Defence Minister Chan Chun Sing, in remarks made on Saturday, confirmed that specific divisions within the Singapore Armed Forces (SAF) and the Ministry of Defence (MINDEF) have been mobilised to handle the situation in coordination with the Cyber Security Agency of Singapore (CSA). “Units in the Singapore Armed Forces (SAF) and Ministry of Defence (MINDEF) have been responding to the ongoing cyberattack by an alleged China-linked threat actor on Singapore's critical infrastructure covering global trade,” he said.

High Stakes and Public Disclosure

The extent of the attack and its potential implications were first revealed on Friday by Coordinating Minister for National Security K Shanmugam. He noted that the UNC3886 group posed a significant threat to Singapore’s national security, describing their methods as “highly sophisticated”.

On Saturday, speaking at a public event, Shanmugam defended the government’s decision to name the alleged attackers, emphasising the importance of public transparency. “The number of incidents we disclose are far smaller than the actual number of attacks,” he stated. “This time round, our assessment was that we can disclose those details.” When asked about China’s involvement and possible repercussions, he responded, “Who they are linked to and how they operate is not something I want to go into,” calling such speculation premature.

Minister for Communications and Information Josephine Teo also addressed the situation in a Facebook post, highlighting the risks to public utilities such as water, electricity, and telecom services. “Imagine if threat actors succeeded in taking down any of our critical systems... The knock-on effects could be devastating,” she warned. Teo said the timing of disclosure is always delicate, balancing operational security with public awareness.

Beijing Denies Allegations, Calls Claims Baseless

Reacting to the accusations, the Chinese Embassy in Singapore issued a strong denial. It criticised local media for citing data from “a certain country's cybersecurity company” and rejected the alleged connection between China and UNC3886.

In its official response, the embassy said: “The embassy would like to reiterate that China is firmly against and cracks down (on) all forms of cyberattacks in accordance with law. China does not encourage, support or condone hacking activities.”

It added that cybersecurity should be a shared global priority, noting, “China stands ready to work with Singapore and the rest of the world to jointly protect cybersecurity.”

Singapore, home to nearly six million residents and an important global trade hub, maintains longstanding economic and cultural ties with China.