Singapore shifts cyber strategy after UNC3886 attacks, deploys AI security tools

SINGAPORE - The local authorities have developed and deployed in-house artificial intelligence tools to better secure some 2,000 government systems under expanded cyber security efforts.

This proactive posture - shifting from perimeter defense to active threat hunting - comes in the wake of an attack on the country’s four major telcos by state-sponsored cyberespionage group UNC3886.

The attack was first made public in July 2025. It could have disrupted telecommunications and internet services had the attackers penetrated further, and threatened national security.

In her first interview since taking over as chief executive of the Cyber Security Agency of Singapore (CSA) in July 2026, Gwenda Fong told The Straits Times that one of the key learning points from the incident is that defences need to go beyond keeping attackers out.

This is because advanced persistent threat actors (APTs) like UNC3886 pursue specific targets.

“APTs are driven by state-backed objectives and you are their target,” said Fong, adding that focusing on threat prevention will not be enough.

Instead, one must now assume that attackers are already inside an operator’s network, and focus on hunting them down before they wreak further havoc.

“You also have to assume that the most well-resourced and qualified attackers will find a way in at some point,” added Fong, in the ST interview on Sept 3.

Once inside, however, attackers still have to move through the network in search of sensitive systems and data, giving defenders opportunities to detect them through unusual activity.

“You need to monitor the internal traffic. You need to detect anomalous traffic behaviour. You need to constantly do threat hunting,” said Fong.

Developed by the Government Technology Agency of Singapore (GovTech), the new AI tools can take on some of this work.

One AI-powered tool conducts automated penetration testing on about 2,000 government systems, some of which contain citizen data and transactions. Automated penetration testing uses software to simulate cyber attacks and identify vulnerabilities that hackers can exploit.

The second AI tool scans the source code of government applications and systems for security weaknesses, allowing agencies to plug the gaps before hackers exploit them.

CSA and GovTech did not reveal which agencies have deployed the AI tools. There are also plans to expand their use in other critical information infrastructure sectors (CII).

The 11 CII sectors in Singapore are government, aviation, healthcare, land transport, maritime, media, security and emergency services, water, banking and finance, energy, and info-communications.

“This work is still at the evaluation stage and involves considering operational requirements, effectiveness and sector-specific needs,” said CSA and GovTech, declining to provide details.

Post-UNC3886, CSA has also started regularly scanning all the Internet-facing systems of CII operators to identify potential entry points for attackers such as unpatched software or weak configurations, so CII operators can fix them before they are exploited.

“It is akin to walking along the common corridor of your HDB flat to see whether your doors and windows are open. We don’t do any active probing, it’s just an external scan to what are the open points of entry,” said Fong.

The moves build on previously-announced efforts to strengthen Singapore’s cyber defences, including rolling out proprietary threat detection tools developed by a technical agency under the Ministry of Defence to all CII operators, and sharing classified threat intelligence with them.

CSA is also looking to tighten the security of supply chains tied to CII operators, as an attack on a vendor could compromise the data or disrupt services down the chain.

“There is a huge swathe of businesses that fall outside the sectors regulated under the Cybersecurity Act, but they are still part of the wider ecosystem we need to secure,” said Fong.

She said that CSA is looking to require some CII operators’ vendors and suppliers to obtain the Cyber Essentials or Cyber Trust mark certifications, potentially as early as 2027.

Launched in March 2022, the two certifications are currently voluntary. Cyber Essentials sets out the baseline cyber security measures for organisations, while the Cyber Trust mark provides five tiers of certification based on the risk profile of organisations and their size.

“It’s not satisfactory just to have it purely voluntary because uptake is extremely slow,” said Fong.

As of August 2026, only 874 Cyber Essentials and 346 Cyber Trust mark certifications were issued.

Fong said these moves come as cyber security evolves from a largely technical concern into a strategic discipline with implications for national security, the digital economy and public trust.

She attributed the shift to three developments: the use of cyber operations as an instrument of strategic competition, the growing influence of geopolitics over access to technologies such as advanced chips and frontier AI models, and society’s increasing reliance on digital infrastructure.

Suspected APT activity in Singapore quadrupled between 2021 and 2024, according to CSA’s Singapore Cyber Landscape 2024 report. Fong expects the upward trend to continue as attackers gain access to AI tools.

At the same time, disruptions to digital systems now have wider consequences because they underpin almost every aspect of work and daily life, she said.

“These have fundamentally changed the nature of cyber security,” said Fong. “It is a much more strategic discipline, and it is fundamentally about protecting trust in our digital infrastructure.”