Zero-Day Cyberattack on Major Telcos in Singapore: Lessons on Securing Privileged Access to Critical Systems 

In a recent event held at the Cyber Security Agency of Singapore’s (CSA) office, it was revealed that four major telcos in Singapore have been attacked by cyber espionage group UNC3886.

The threat actors exploited a zero-day vulnerability at the perimeter firewall – extracting credentials using malware to access internal systems in the telcos. Although they managed to access several critical systems, only technical data was extracted, and no disruption of services was recorded.

Broader implications

A breach of telco infrastructure can result in significant consequences. A disruption of critical infrastructure like telcos can affect all phone and internet connections in the country, potentially causing a knock-on effect on other essential services like banking and finance, transport, and healthcare.

Incidents like this have also been reported in other countries. In 2025, SK Telecom in South Korea was the target of a cyberattack which exposed the SIM data of almost 27 million users. In the same year, the US authorities reported that the advanced persistent threat (APT) group called Salt Typhoon had stolen critical defence and law enforcement information by breaking into critical systems of telecommunications providers.

Securing access to critical infrastructure

In cases like this where zero-day vulnerabilities are exploited to access critical systems, organizations need to re-assess their defensive strategies – strengthening security perimeters to make sure that the “keys” to your critical systems are always secure.

The concept of Zero Trust was introduced to address these vulnerabilities. By applying the principle of least privilege, every user is authenticated at all times, at every step of the way.