Friday, July 25, 2025
boy in boy childhood
why I didn't choose brand sch for my dd
infertility in men
china
When the Government revealed that the country’s critical infrastructure was under attack from cyber threat group UNC3886, Singaporeans responded by snapping up those 4-D betting numbers. From a glass-half-full perspective this, at least, showed that the message was heard.
This was “peak Singapore” behaviour, as one commentator put it on X.
Even Coordinating Minister for National Security and Minister for Home Affairs K. Shanmugam noted this trend following his widely reported July 18 speech on the “advanced persistent threats” posed by UNC3886.
A day after his warning – which global media outlets picked up – he highlighted on Facebook how the number 3886 had quickly sold out on Singapore Pools for both big and small bets.
He wrote: “I said Singaporeans need to know that UNC3886 is attacking us in cyberspace. And that it’s very serious. One reaction: No. 3886 has been sold out for 4-D today.”
There was a hint of wryness, perhaps, but surely, better this than the message falling on deaf ears.
The light-hearted response aside, Mr Shanmugam’s revelation has opened up several critical debates – not least whether UNC3886 is, in fact, China-linked. The minister named UNC3886 but did not identify the state actor behind it, though Mandiant – a highly reputable cyber-security firm and part of Google – labels the entity a “China nexus espionage group”.
Some, who regard China as intrinsically benign, dismiss this label as Western geopolitical spin. But Singaporeans should recognise Mandiant’s established credibility in global cyber security. Beijing’s denials – including a statement from its embassy in Singapore after Mr Shanmugam’s speech – alone are not sufficient to brush these claims aside.
The ‘why’ and ‘how’
However, even setting aside attribution, a bigger question looms: Why Singapore?
Cyber attacks on civilian infrastructure aren’t unprecedented. Examples include Russia’s sabotage of Ukraine’s power grid in 2015 and 2016, and Israel-linked hacker group Predatory Sparrow’s recent attacks on Iranian military-linked banks.
The Israeli-US Stuxnet worm attack in the 2000s is another case – it crippled Iran’s centrifuge machines, which were ostensibly for civilian nuclear use but suspected of weapons development. One of the largest campaigns saw Russia-linked hackers target over 1,000 oil and gas firms across 84 countries in the Western world. This was first discovered by CrowdStrike in 2012.
Yet these past attacks shared a common thread – they targeted adversaries or nations locked in clear conflict. Singapore’s situation is markedly different. The Republic notably has friendly ties with all major powers, making the cyber attacks particularly baffling.
More worrying still is that this infiltration goes beyond routine cyber espionage of telecom and wireless networks – an established if unwelcome practice among states. The focus on critical civilian infrastructure marks a serious escalation.
In the US, a hardening view – openly expressed by Washington officials – is that China-linked cyber threat groups undertake attacks not merely to extract military or commercially sensitive information but to infiltrate the infrastructure underpinning civilian life, ready to unleash chaos when geopolitical tensions spike.
This assessment was starkly illustrated by Ms Jen Easterly, director of the US Cybersecurity and Infrastructure Security Agency during President Joe Biden’s tenure.
She testified in Congress in January 2024 that in a conflict over Taiwan, China could leverage this latent access to launch damaging cyber attacks against critical infrastructure in the US or allied countries. The goal would be disrupting lives and potentially harming civilian populations.
On her agency’s assessment of China’s motive, Ms Easterly noted: “This is truly an Everything Everywhere, All At Once scenario. And it’s one where the Chinese government believes that it will likely crush American will for the US to defend Taiwan in the event of a major conflict there.”
Beyond “why”, the “how” of these attacks is also deeply alarming.
As Mr Shanmugam indicated, successful sabotage could have a cascading effect across the island. He mentioned that an attack on the power system, for instance, could affect everything from water supply and transport to medical services – not to mention the impact on the economy if the Republic’s banks, airports and industries cannot operate.
One real-world example of an attack on civilian infrastructure is the May 2021 hack by an affiliate of DarkSide, a Russia-linked cybercrime group, that took down America’s largest fuel pipeline for six days. The attack on Colonial Pipeline caused shortages across the country’s East Coast and a spike in fuel prices.
Harder to counter
The consensus across the cyber-security industry is that these threats are becoming harder to counter.
One fear is that groups might leverage agentic AI, which could supercharge their operations by making autonomous key functions such as writing malware, devising and executing phishing campaigns, exfiltrating and encrypting data, and issuing ransom demands.
The other problem cyber-security circles have been discussing is the trend of private players conducting cyber attacks and hacking campaigns on behalf of state actors who previously undertook hacking in-house.
These “hackers for hire” discover previously unknown “zero-day” flaws in software, search for where the vulnerable programmes are installed, hack many of them simultaneously, and then sell access to multiple government customers and other security companies.
A July 16 Washington Post report detailed this trend by what it said were Chinese actors. The report cited CrowdStrike data showing that hacks from suspected Chinese government actors doubled from 2023 to more than 330 in 2024. The numbers continued to climb as President Donald Trump’s administration took over.
The newspaper quoted unnamed US officials saying that bursts of espionage are typical with each new president.
Mr Shanmugam, in his speech, noted that the advanced persistent threats undertaken by the likes of UNC3886 had increased “more than four-fold” between 2021 and 2024.
Naming and shaming
So what’s the point of naming UNC3886 now?
The act of publicly attributing cyber threats like UNC3886 should not be underestimated. Although the Singapore Government chose not to explicitly identify the state actor behind the group, simply naming it publicly carries significance.
The official rationale, gleaned from government remarks, seems to place public awareness at the heart of the decision.
Mr Shanmugam clearly made this point during a doorstop interview on July 19, following his speech a day earlier. Minister for Digital Development and Information Josephine Teo echoed this reasoning on Facebook, writing: “Singaporeans should be aware about the ongoing threats we face in cyberspace and there is never a perfect time to disclose such incidents.”
There’s a strong case that these disclosures help build public backing for cyber-security policies, justify greater investment in cyber defences, and pave the way for tougher diplomatic responses against offending state actors should the need arise.
What was perhaps left unsaid – but remains just as significant – is the likely signalling to the foreign actors behind these advanced persistent threats.
That message would have been amplified by the whole-of-government response that followed Mr Shanmugam’s speech. Alongside Ms Teo, Defence Minister Chan Chun Sing also weighed in, noting that Singapore Armed Forces and Ministry of Defence units would collaborate closely with the Cyber Security Agency of Singapore to counter UNC3886.
Taken as a whole, the official message to the foreign actors can be summarised as “We see you, we’re tracking you, and we’re ready”.
In Singapore’s case, subtlety remains essential. Unlike the US, Singapore does not have the geopolitical influence to name state actors outright without risking diplomatic repercussions. Nevertheless, publicly identifying UNC3886 sends a clear message to any actor behind advanced persistent threats: Singapore intends to respond firmly – if not always preventing successful attacks, certainly swiftly containing them.
- Bhavan Jaipragas is deputy Opinion editor and a columnist at The Straits Times.