All four of them. M1, SIMBA Telecom, Singtel, StarHub: every major telecommunications operator in Singapore, breached by a single Chinese-nexus threat actor operating undetected for nearly a year inside one of Asia’s most digitally advanced economies.
Singapore’s Cyber Security Agency confirmed the extent of the compromise in early 2026, disclosing that the response had required what Minister Josephine Teo described as the largest coordinated national cyber defence operation in the country’s history: Operation CYBER GUARDIAN, over 100 defenders drawn from six government agencies, working for eleven months to understand the group’s access and limit the damage.
That’s the headline. The operational picture behind it is considerably more instructive.
UNC3886: What Makes This Group Different
UNC3886 was first documented by Mandiant, which attributed the group to China-aligned intelligence collection operations. The “UNC” designation signals that formal attribution to a specific Chinese intelligence service hasn’t been established publicly, though its tasking, capabilities, and operational patterns are consistent with PRC state direction.
Documented activity dates to late 2021, with formal disclosure of significant campaigns beginning in 2022. What’s distinguished UNC3886 through successive campaigns is continuous capability development: each disclosure has revealed expanded zero-day capability, new malware families, or demonstrated ability to navigate segmented enterprise environments that most threat actors cannot effectively cross.
Four characteristics define how this group operates:
Zero-day focus on enterprise infrastructure products. UNC3886 invests in discovering or acquiring previously unknown vulnerabilities in firewalls, VPN appliances, and hypervisors: specifically the products that sit at the perimeter or underpin virtualised infrastructure, and that are rarely covered by endpoint detection. The vendors affected to date: Fortinet, VMware, and Juniper Networks simultaneously.
Kernel-mode Linux rootkits. Most APT groups rely on application-layer persistence. UNC3886 deploys rootkits at the kernel level, persistence that survives standard incident response. When you reimage the machine, the rootkit is gone. But if you didn’t know to look for it, the access you thought you remediated may not have been fully remediated.
VMware hypervisor pivoting. The ability to move between virtual machine guests and the ESXi host, and between guests via the hypervisor layer, is technically complex and not commonly observed. UNC3886 has it. Organisations that believe network segmentation between VMs provides meaningful security isolation need to read the next section carefully.
Long dwell time. UNC3886 consistently records dwell times measured in months. Undetected persistent access is the operational objective. Speed is not.
The Attack Chain in Detail
Zero-Day Entry Points
UNC3886 consistently enters through vulnerabilities in internet-facing enterprise network infrastructure. The CVEs attributed to the group form a specific pattern: edge devices and virtualisation platforms:
- CVE-2022-41328: Fortinet FortiOS path traversal
- CVE-2022-42475: Fortinet FortiOS SSL-VPN heap overflow, remote code execution
- CVE-2023-27997: Fortinet FortiOS SSL-VPN heap overflow, critical severity
- CVE-2023-34048: VMware vCenter out-of-bounds write, remote code execution
The ability to weaponise vulnerabilities across multiple vendors simultaneously indicates significant internal vulnerability research capability, high-quality exploit acquisition, or both. The FortiOS SSL-VPN attack surface has been a recurring target: organisations still running unpatched versions of these products are providing entry points.
The Rootkit Combination
Once inside, UNC3886 deploys two distinct Linux rootkits that serve complementary functions.
REPTILE operates at the kernel level, hiding processes, files, and network connections from the operating system itself. Standard forensic tools that query the OS to understand what’s running or what’s connected will not see REPTILE’s presence. The rootkit also provides reverse shell access, allowing operators to re-enter compromised systems without relying on conventional implants that endpoint tools might eventually detect.
MEDUSA takes a different approach: LD_PRELOAD injection, which hooks into the Linux dynamic linker to intercept system calls before they reach the kernel. MEDUSA functions primarily as a credential logger, capturing authentication credentials as they pass through system processes and enabling arbitrary command execution while doing so. The LD_PRELOAD approach is particularly difficult to detect because it manipulates legitimate system library loading rather than modifying the kernel directly.
Together, these two rootkits provide comprehensive stealth: REPTILE hides the presence, MEDUSA harvests credentials silently. By the time either is detected, assume the adversary has credentials for everything that was authenticated on the compromised system during their dwell period.
VMware Environment Compromise
The capability that makes UNC3886 strategically dangerous to virtualised enterprise environments is its ability to pivot across VMware ESXi hypervisor environments using VIRTUALSHINE, VIRTUALPIE, and VIRTUALSPHERE: backdoors that leverage VMware’s VMCI (Virtual Machine Communication Interface).
VMCI is a low-level communication mechanism between guest VMs and the ESXi host, normally used for legitimate hypervisor management functions. UNC3886 implants backdoors on both ESXi hosts and guest virtual machines, achieving guest-to-guest and host-to-guest command execution that bypasses network-layer segmentation entirely. If you’ve segmented your virtualised environment at the network layer and assumed that separation provides security isolation between VMs, it doesn’t: not when the adversary has ESXi host-level access.
This matters because virtualised infrastructure is pervasive across enterprise environments. Security teams that have invested in network segmentation between VM workloads may be significantly overestimating the protection that segmentation provides against an adversary with this capability.
Command and Control Resilience
UNC3886 maintains multiple C2 channels to ensure operators retain access even if individual implants are discovered.
MOPSLED is a modular backdoor communicating via HTTP-based C2, with plugin architecture allowing capability expansion post-compromise. RIFLESPINE uses Google Drive for command and control, a deliberate design choice to blend into legitimate enterprise cloud storage traffic that is rarely blocked or scrutinised. Communications with Google Drive are encrypted and indistinguishable from legitimate use at the network layer.
CASTLETAP and LOOKOVER provide additional persistence and communication channels, redundancy that ensures operators retain access even during active incident response efforts.
Targeting Pattern
Telecommunications is the sector most prominently affected by the Singapore campaign. Telecom access provides persistent visibility into communications metadata, the ability to monitor high-value individuals at scale, and potential for disruption as a coercive tool. The specific data exfiltrated in Singapore, primarily network-related technical information including routing data and infrastructure maps, is consistent with intelligence collection supporting future offensive planning against the region’s communications backbone. That’s exactly the kind of information you’d want if you were planning a disruptive operation.
Beyond Singapore: energy sector organisations across Asia, government agencies and defence contractors across Asia, North America, and Europe, and technology companies holding sensitive intellectual property or serving government clients. The geographic breadth of UNC3886 targeting reflects a global collection mandate.
The Singapore Timeline
Mandiant published the first comprehensive documentation of UNC3886 activity in 2022, revealing sustained exploitation of Fortinet FortiOS and VMware vCenter zero-days against government and telecoms targets in Asia and North America. The group had been active undetected since late 2021.
Through 2023 and 2024, successive publications documented expansion into Juniper Networks JunOS-based routing infrastructure alongside new VMware ESXi zero-day exploitation (CVE-2023-20867). Each disclosure revealed new capability that hadn’t been publicly attributed to the group before.
Singapore’s formal attribution in 2025 confirmed what the preceding research had suggested was coming: the group had achieved persistent access across every major carrier in a single, digitally sophisticated nation. Eleven months of Operation CYBER GUARDIAN to understand and partially remediate that access. Singapore confirmed that exfiltration was limited to technical network data, with no evidence of personal customer data exfiltration or service disruption. But the nature of what was taken suggests the campaign’s objectives were met regardless.
What Defenders Need to Do Differently
Edge devices are the attack surface, not the perimeter. The immediate priority for any organisation running Fortinet, VMware, or Juniper infrastructure is aggressive patch cadence for all edge networking equipment, combined with NDR tools monitoring traffic from those devices, and network segmentation limiting what a compromised edge device can reach. Treating these products as trusted infrastructure is the wrong posture.
VMware environments need ESXi-specific security review. Audit ESXi configurations to restrict VMCI capabilities where possible. Deploy host-based integrity monitoring on ESXi hosts. Monitor for unusual VM-to-VM or guest-to-host communication patterns. If you’re relying on VM-level network segmentation to provide security isolation and you haven’t validated that assumption against an adversary with hypervisor-level access, that assumption should be revisited.
REPTILE and MEDUSA require offline forensics to reliably detect. By the time these rootkits are active, standard tools that query the OS may return incorrect results. Kernel integrity monitoring tools capable of detecting modifications to kernel modules and LD_PRELOAD manipulation (rkhunter, chkrootkit, commercial EDR with Linux kernel monitoring) should be deployed. Plan for offline analysis of filesystem images as part of any incident response involving compromised Linux infrastructure.
RIFLESPINE’s Google Drive C2 is specifically hard to block. Cloud access security broker controls monitoring Google Drive API usage patterns from server infrastructure, where legitimate Drive access should be essentially absent, provide the best detection path. Anomalous DNS and HTTPS patterns to Google APIs originating from servers rather than workstations are the signal.
Singapore’s experience is the clearest recent illustration that even well-resourced, sophisticated defenders in advanced economies cannot rely on perimeter controls and endpoint detection to catch a group operating with zero-day capability, kernel-level rootkits, and the patience to move slowly. The adversary is not in a hurry.