Sharing ‘weak signals’ early vital as cyber threat actors refine tactics: Cyber agency chief

Singapore's cybersecurity agency, CSIT, is emphasizing the importance of early sharing of "weak signals" to combat increasingly sophisticated cyber threats, according to Chief Executive Darren Teo. Since UNC3886, a state-sponsored cyber espionage group, infiltrated Singapore's critical information infrastructure in July 2025, attackers have been detected and dealt with more effectively through collaborative information sharing.

This shift away from isolated responses marks a significant improvement over previous practices, where CII operators typically only reached out to IT vendors upon encountering cyber issues. The introduction of the Digital Defence Hub (DDH) in October 2025, focused on countering advanced threat actors like APT groups, has further bolstered this collaborative approach, fostering greater willingness among stakeholders to exchange weak signals and conduct joint investigations.

While UNC3886's attacks on major telcos served as a wake-up call, Teo acknowledges that further advancements in data privacy and competition protocols are necessary to facilitate this collaboration. CSIT and the DDH have been working on establishing clear protocols to share sensitive information, which is expected to streamline information flow and enhance proactive threat hunting.

Additionally, CSIT has implemented sensors in Singapore's CII networks to better detect APT activities, combining threat intelligence data with telemetry data to uncover stealthy attacks. The latest Singapore Cyber Landscape report predicts that state-sponsored cyber activity in 2026 will prioritize credential accumulation and "strategic optionality" over immediate disruption.

Teo anticipates that artificial intelligence will accelerate the speed and scale of cyber attacks, but emphasizes the importance of pairing AI capabilities with human expertise to ensure effective cybersecurity.