Opening Speech by Minister Josephine Teo at the Operation CYBER GUARDIAN Engagement Event For Cyber Defenders on 9 Feb 2026

Colleagues and friends,

Introduction

1.   Last year in July, our Coordinating Minister for National Security, Minister Shanmugam disclosed that we had detected a cyber-attack against our critical information infrastructure.

a.   This was a serious attack.

b.   The attacker was UNC3886, an entity with advanced capabilities.

c.   They are persistent, and do not give up easily just because they have been detected or identified.

2.   That same weekend, at my constituency event, some curious residents asked me “Are we really under attack? How do we know?”

3.   In fact, UNC3886 is not the first cyber-attack to target Singapore.

a.   In 2014, an attacker likely linked to a foreign Government gained access into the Ministry of Foreign Affairs’ IT system and tried to steal sensitive information.

b.   In 2018, attackers infiltrated SingHealth’s systems and stole more than 1.5 million records, including that of former Prime Minister Lee Hsien Loong. These attackers were also likely linked to a foreign Government.

4.   UNC3886 posed a potentially more serious threat than these previous attacks.

a.   It targeted critical systems that directly provide vital essential services to the public.

b.   At stake was not just sensitive data.

c.   The consequences could have been more severe; if the attack went far enough, it could have allowed the attacker to one day cut off telecoms or internet services.

5.   But the residents’ questions remind us that the potential consequences of a cyber-attack are not well known.

a.   Besides the loss of data or sensitive information, there are usually no visible signs in the physical world, such as collapsed buildings or human casualties.

b.   As a result, most people find it hard to picture cyber-attacks and the growing risks we face.

6.   Yet, around the world, state-linked threat actors have stepped up their activities.

a.   Last year, US authorities reported that an Advanced Persistent Threat (APT) actor known as Volt Typhoon had infiltrated US critical infrastructure.

i.   They were found not just in one sector but several.

ii.   These include the energy, water, transportation, and telecommunications sectors.

b.   In December last year, Polish authorities reported a sophisticated cyberattack targeting Poland’s power grid.

i.   The threat actors did not succeed.

ii.   But we can imagine the severe consequences if they did.

iii.   The loss of electricity and heating would be the start.

iv.   Thereafter, factories, hospitals, airports and trains, anything that relies on power, would potentially all come to a standstill!

Singapore’s Telcos Attacked

7.   This is why we do not take lightly the attack mounted by UNC3886.

8.   At a broader level, if such cyber threats are not properly dealt with,

a.   We may eventually allow the attackers to steal national secrets.

b.   In the worst scenario, the disruption of essential services can cripple economies and weaken a nation’s ability to protect its citizens.

c.   It is precisely because the impact can be so severe that APTs are often state-sponsored.

9.   Therefore, since UNC3886 was discovered, CSA and relevant partner agencies have been working closely with the affected companies to investigate the attack and ensure our systems remain safe to use.

a.   Our investigations show that the attacks by UNC3886 were a deliberate, targeted, and well-planned campaign against our telecommunications sector.

b.   All four of our major telcos – Singtel, StarHub, M1 and Simba – have been targets of attacks.

10.   In what ways could we see the sophistication of UNC3886?

a.   In one instance, they used a zero-day exploit – a hidden flaw, with no known fix.

b.   This is like finding a new key that no one else had found, to unlock the doors to our telcos’ information system and networks.

c.   Once it gained entry, UNC3886 managed to steal a small amount of technical data – likely data that will help them to understand the terrain and what they are dealing with.

11.   Like other APTs, UNC3886 also used advanced techniques to cover their tracks and evade detection. This made it a bigger concern.

a.   First, they were more capable of accessing sensitive information for espionage.

b.   Second, they could deploy more tools to disrupt telecoms and internet services. Everything that requires a phone or internet connection would then be affected.

c.   The knock-on effects of their campaign could also have included other essential services like banking and finance, transport, and medical services.

12.   There is no shortage of examples overseas that show the damages caused by compromised telco infrastructure.

a.   In April of last year, an attack on SK Telecom in South Korea exposed the SIM data of nearly 27 million users.

b.   Last year, US authorities reported that APT group Salt Typhoon had infiltrated a large number of US telecommunications providers and may have obtained sensitive military or law enforcement information.

13.   Successful cyber-attacks can also affect the trust and confidence in Singapore as a whole, and our economic security.

a.   We are a trusted international financial, logistics centre. Many MNCs also choose to house their global headquarters here because of our safe and reliable digital connectivity.

b.   Businesses may shy away from Singapore if they are unsure about our systems – whether the systems are clean, resilient, and safe.

Operation Cyber Guardian

14.   So far, the attack by UNC3886 has not resulted in the same extent of damage as cyberattacks elsewhere.

a.   This is not a reason to celebrate.

b.   Rather it is to remind ourselves that the work of our cyber defenders matters.

c.   We depend on their vigilance and hard work to keep Singaporeans safe.

15.   Who are these cyber defenders and what did they do in this case? Allow me to share a few examples:

a.   Mr Alex Aw is a senior cybersecurity consultant with CSA’s National Cyber Incident Response Centre. He and his team were one of the first responders to the incident, executing strategies to contain the attack and collect evidence for forensic investigation.

b.   Mr Anson Yap, a Threat Intelligence and Response specialist from IMDA, and ME5 Eugene Tay, from the Cyber Protection Group of the Digital Intelligence Service, led teams to study the affected networks and hunt for threats within the telco networks.

c.   There are many others like them across our agencies and in our telcos, who work round the clock to monitor and detect potentially hostile activities across their systems.

16.   Upon discovery of the breach, cyber defenders in the telcos promptly alerted IMDA and CSA.

a.   CSA, IMDA, and other government agencies swiftly launched a coordinated response in partnership with our telcos, to contain the breach.

b.   A multi-agency effort, codenamed Operation CYBER GUARDIAN, was mounted.

17.   Operation CYBER GUARDIAN is the largest coordinated cyber response from Singapore to date.

a.   It involved more than 100 cyber defenders across six government agencies – CSA, IMDA, the SAF’s Digital and Intelligence Service (DIS), Centre for Strategic Infocomm Technologies (CSIT), Internal Security Department, and GovTech – all working in close partnership with our telcos.

b.   Operation CYBER GUARDIAN has managed, for now, to limit the attackers’ activities.

18.   So far, our attackers have not been able to get further into our telco networks.

a.   In one instance, they were able to gain access to a few critical systems, but did not get far enough to have been able to disrupt services.

b.   There is also no evidence thus far to suggest that the attackers were able to access or steal sensitive customer data from our telcos.

19.   It is not a given that the public and private sectors work as closely as they did to implement Ops CYBER GUARDIAN. We have been able to do so, due in large part, to our national doctrine of cyber defence.

a.   In 2020, government agencies came together to author a classified document that outlines Singapore’s approach to cyber defence. It guides our approach to capability development, and outlines the roles and responsibilities of both the public and private sector in our cyber defence, and the actions that should be undertaken during a cyber incident. We have been working on this and practicing our plans for several years, but this is the first time we have implemented the plan in an actual operation.

b.   For a digitally connected country like Singapore, the coordinated approach laid out in the doctrine ensures that we are able to effectively protect our cyberspace, with the resources we have available.

Cyber Defence: A continuing fight and a shared responsibility for all

20.   But we must also be realistic.

21.   Whilst our collective defensive efforts have contributed to containing the attacks so far, we are up against very sophisticated and persistent actors.

a.   Some are backed by countries with formidable resources both in manpower and technology.

b.   These threat actors will not give up so easily to regain a firmer foothold in our telco systems.

22.   We must also be prepared that our other critical infrastructure, such as our power, water and transport systems may be targeted. After all, they are common targets in other countries!

23.   In short, the fight continues, and we must all do our part.

24.   Our critical infrastructure operators, many of whom are private companies, play an especially important role.

a.   You are at the frontlines of the battle against cyber threat actors. Your actions, or inaction, can determine whether we succeed or fail in protecting our critical infrastructure, and our national security.

b.   I urge all of you to continue investing in upgrading your capabilities as well as your systems.

c.   Leaders, including at the Board and Management levels, must also take cybersecurity seriously and provide close oversight to their teams.

25.   The Government will continue to partner you closely in this.

a.   We have been organising cybersecurity exercises like Exercise Cyber Star and CIDEX to improve our readiness and incident response.

b.   As shared previously, we have also taken steps to share classified threat intelligence with critical infrastructure operators to facilitate early threat detection and response.

26.   But even as we try our best to prevent and detect cyber-attacks, we may not always find ourselves in a position to stop all of them. We must therefore be prepared for the threat of disruption. This is also why the focus of this year’s Total Defence exercise is readiness in the face of disruptions.

Conclusion

27.   In conclusion, today’s event recognises the vital role of our cyber defenders. Your good work helps keep Singaporeans safe.

28.   At the same time, we acknowledge the need to work together as a team, so that we can be effective against very sophisticated adversaries.

29.   Let’s keep up the strong partnership to collectively protect everything we care