Singapore shifts cyber strategy after UNC3886 attacks, deploys AI security tools

The Singaporean government has bolstered its cyber security strategy in the aftermath of an attack by the state-sponsored cyberespionage group UNC3886 on the country's four major telecommunication companies. This attack, revealed in July 2025, threatened national security by potentially disrupting telecommunications and internet services.

Cyber Security Agency of Singapore (CSA) chief Gwenda Fong revealed that the government now deploys AI security tools to fortify 2,000 government systems, moving away from merely preventing attacks to actively hunting down threats. Fong emphasized that advanced persistent threat actors (APTs), like UNC3886, target specific entities, making traditional defense strategies insufficient.

The two key AI tools developed by the Government Technology Agency of Singapore (GovTech) are designed for automated penetration testing and scanning source code for security weaknesses. CSA plans to expand the use of these AI tools in other critical information infrastructure sectors, including aviation, healthcare, and banking.

Additionally, CSA has initiated regular scans of Internet-facing systems of critical information infrastructure operators to identify potential vulnerabilities. Fong also highlighted the need for tightening security in supply chains, suggesting that vendors and suppliers of CII operators might need to obtain Cyber Essentials or Cyber Trust mark certifications, potentially starting in 2027.

These measures come as cyber security transforms into a strategic discipline with implications for national security, the digital economy, and public trust, driven by the use of cyber operations as strategic tools, geopolitical influences on technology access, and society's growing dependence on digital infrastructure.