UNC3886: Inside the Chinese Cyber Espionage Operation That Breached All Four of Singapore's Major Telcos

Executive Summary

On February 9, 2026, Singapore's Cyber Security Agency (CSA) publicly disclosed that UNC3886 — a China-nexus advanced persistent threat group tracked by Mandiant (Google Cloud) since 2022 — had breached all four of the nation's major telecommunications providers: Singtel, StarHub, M1, and SIMBA Telecom. The attackers exploited an undisclosed zero-day vulnerability in a perimeter firewall, deployed kernel-level rootkits across network infrastructure, and exfiltrated a small amount of technical data over an extended period before detection during 2025. Singapore's response — Operation CYBER GUARDIAN — mobilized over 100 cyber defenders from six government agencies across more than 11 months, marking the nation's largest coordinated cyber incident response in history.

This post breaks down the technical details: how UNC3886 operates, what makes their tradecraft uniquely dangerous, and what defenders should be looking for.

Threat Actor Profile

What separates UNC3886 from most threat actors is their deliberate avoidance of monitored endpoints. They don't target laptops and servers where EDR agents are watching. Instead, they target the infrastructure between those endpoints — firewalls, routers, hypervisors — devices that process all of an organization's traffic but almost never have endpoint detection software installed. These are the blind spots of enterprise security, and UNC3886 has turned exploiting them into an art form.

The Singapore Incident: What Happened

Operation CYBER GUARDIAN Stats

Initial Access: The Undisclosed Zero-Day

UNC3886 gained entry through a previously unknown zero-day vulnerability in a perimeter firewall deployed by at least one of the four telcos. Singapore's authorities declined to disclose the CVE or the affected vendor. Minister Josephine Teo described it as "like finding a new key that no one else had found, to unlock the doors to our telcos' information system and networks."

This is consistent with UNC3886's established playbook. The group has historically exploited zero-days in edge devices from Fortinet, VMware, Juniper, and Ivanti — products that sit at network perimeters and rarely have EDR coverage. Once they owned the firewall, they had a foothold outside the reach of standard endpoint monitoring.

Post-Exploitation: Rootkits and Evasion

Once past the perimeter, UNC3886 deployed custom rootkits at the operating system level of compromised network devices. These rootkits rewrote system files, blocked antivirus scans, erased and tampered with logs, and maintained administrator-level access while disabling security features. CSA noted this "made it challenging for cyber defenders to detect the actor's presence, requiring comprehensive security checks."

Objectives and Impact

According to CSA, the attackers exfiltrated a small amount of technical data described as primarily network-related, likely to advance the threat actor's operational objectives. While CSA did not specify exactly what this comprised, network-related technical data from a telecommunications provider could include routing configurations, network topology, or infrastructure design — the kind of intelligence that tells a state actor how a nation's telecommunications backbone is constructed, where its critical nodes are, and how it could be disrupted.

They deliberately avoided customer-facing systems. The operation was focused, disciplined, and restrained — hallmarks of a professional intelligence operation. In one telco, investigators found the attackers had gained limited access to critical systems but had not penetrated deep enough to disrupt services.

The Zero-Day Arsenal

UNC3886 has weaponized at least six zero-day vulnerabilities across multiple vendors. Understanding each one explains how they move through a target environment layer by layer.

The CVE-2023-34048 case deserves special attention. UNC3886 exploited this vCenter vulnerability for approximately two years before it was discovered. During that window, any reachable vCenter server was effectively an open door. Mandiant found that in most compromised environments, the attackers had deliberately deleted the vmdird core dump files that would have served as forensic evidence of exploitation, while leaving the surrounding log entries intact — a precise anti-forensics action.

Technical Deep Dive: The Malware Arsenal

UNC3886 has built over 20 custom malware families, each designed for a specific platform. Here's how the key ones work.

Fortinet Platform Implants

CASTLETAP — The group's signature FortiGate backdoor. It installs at /bin/fgfm, mimicking the legitimate FortiGate-to-FortiManager daemon (fgfmd). CASTLETAP creates a raw promiscuous socket to passively sniff all network traffic traversing the firewall. It sits dormant until it detects a specially crafted ICMP packet containing a magic string — a technique known as port knocking. Only then does it activate and establish an SSL-encrypted reverse connection to the C2 server, using acknowledgement token ;7(Zu9YTsA7qQ#vw.

This design is deliberate: because the backdoor generates zero outbound traffic until activated, network monitoring tools see nothing anomalous. The firewall looks completely normal.

TABLEFLIP — A traffic redirection utility deployed on FortiManager devices. FortiManager typically restricts inbound access to TCP port 541 (FortiGate management traffic) via ACLs. TABLEFLIP manipulates routing rules to redirect incoming attacker traffic past these ACLs directly to the REPTILE backdoor's listening port. It effectively punches a hole through the firewall's own access controls.

THINCRUST — A Python-based backdoor targeting FortiManager appliances. It backdoors the FortiManager API, giving the attacker a persistent management-plane foothold that can push configurations and commands to every FortiGate device managed by that instance.

BOLDMOVE — A full-featured C-based backdoor specifically designed for FortiOS. It performs system reconnaissance, provides a remote shell, handles file transfers, and can relay traffic. The Linux variant manipulates FortiOS-specific features. A Windows variant was compiled as early as 2021, indicating long-term development.

VMware Platform Implants

VIRTUALPITA — Delivered through malicious vSphere Installation Bundles (VIBs) — VMware's native plugin format for ESXi. By packaging their backdoor as a VIB, the malware appears as a legitimate VMware extension. It persists in the ESXi host's /bin directory with startup scripts in /etc/rc.local.d/ ensuring it survives reboots. It creates a listener on a hardcoded port, impersonating legitimate VMware service names.

VIRTUALSHINE — This is arguably UNC3886's most innovative implant. It uses VMCI sockets (Virtual Machine Communication Interface) for command-and-control. VMCI is VMware's internal mechanism for communication between the ESXi hypervisor and guest VMs. The critical property: VMCI traffic operates entirely within the bare metal hardware and never touches the network stack. This means:

• Standard network firewalls do not inspect it
• Network IDS/IPS does not have visibility into it
• Standard packet captures will not contain it
• NetFlow/traffic analysis will not surface it

VIRTUALPIE — Another Python-based backdoor, this one targeting ESXi hosts directly. It provides a lightweight command execution and file transfer capability on the hypervisor itself.

The attacker controls the hypervisor with VIRTUALSHINE and uses VMCI to send commands down into guest VMs through a channel that exists below the operating system's network layer. To the guest VM, it looks like internal VMware communication. To standard network monitoring, it's not visible.

Juniper Router Implants: The Veriexec Bypass

Juniper's Junos OS (built on FreeBSD) includes Veriexec — a kernel-based file integrity system that prevents unauthorized binaries from executing. Disabling Veriexec triggers alerts. UNC3886 found an elegant bypass:

Because cat is a trusted system binary, Veriexec's integrity verification is satisfied. The injected shellcode then executes a position-independent code variant of TINYSHELL. UNC3886 deployed six distinct TINYSHELL variants on Juniper MX routers:

Note the lmpad variant: it hooks into Juniper management processes to disable logging before the attacker connects and restores logs afterward. The attacker's session leaves no trace in the device's audit trail.

The Rootkit Layer: REPTILE and MEDUSA

Once UNC3886 establishes access, they deploy two complementary rootkits to ensure persistence and credential harvesting:

REPTILE (Kernel-Level) — A Linux Loadable Kernel Module (LKM) rootkit with three components:

• REPTILE.CMD — User-mode component that manages kernel hooks. Hides files, processes, and network connections by intercepting system calls. Files enclosed with the string #<Centos_Selinux_Config_And_Module> are hidden from all directory listings.
• REPTILE.SHELL — Reverse shell backdoor activated by magic packets via TCP, UDP, or ICMP port knocking.
• Kernel Module — The LKM itself, intercepting system calls at the kernel level to cloak all malicious activity.

UNC3886 customized REPTILE deployments with TLS support using the victim's own legitimate TLS certificates and private keys (stolen from compromised FortiGate devices) to encrypt reverse shell traffic. Unique keywords were modified per target to defeat signature-based detection.

MEDUSA (User-Space) — A dynamic linker rootkit using LD_PRELOAD to hijack shared library loading. While REPTILE operates at kernel level, MEDUSA operates in user-space by injecting itself before standard library functions execute:

• PAM hooking — Intercepts PAM authentication to create hidden persistence
• Credential logging — Captures passwords from local and SSH logins
• Command logging — Records all commands executed on the system
• Process/file/network hiding — Hooks kill(), stat(), readdir(), and getaddrinfo() to conceal malicious artifacts

MEDUSA's SSH credential hijacking placed executables at /usr/sbin/libvird and /usr/bin/NetworkManage (deliberate misspellings of legitimate services). Harvested credentials were XORed with 0xEF and written to /var/log/ldapd<keyword>.2.gz.

C2 Channels: Hiding in Plain Sight

UNC3886's command-and-control infrastructure uses multiple channels designed to blend with legitimate traffic:

How It All Chains Together

Each layer of the attack feeds into the next. The firewall gives them credentials. The credentials give them vCenter. vCenter gives them the hypervisor. The hypervisor gives them every VM — silently. And stolen network credentials give them the routers in parallel.

The Credential Harvesting Pipeline

UNC3886 doesn't just steal credentials — they built an industrialized pipeline that feeds harvested credentials back into the operation at scale:

TACACS+ credentials unlock routers and switches. SSH credentials unlock servers. vpxuser credentials unlock ESXi hosts. Domain hashes unlock Active Directory. Each credential type opens a new layer of the network, and every tool continuously feeds the pipeline.

MITRE ATT&CK Mapping

Detection and Hunting Guidance

Given UNC3886's focus on blind spots, detection requires extending visibility beyond standard endpoint and network tools.

Fortinet Devices

• Verify firmware integrity against known-good hashes from Fortinet
• Check for unexpected binaries in /bin/ (especially /bin/fgfm and /bin/klogd)
• Monitor for raw promiscuous sockets on FortiGate appliances
• Inspect FortiManager for Python-based API call backdoors
• Audit iptables/nftables for unexpected traffic redirection rules

VMware Infrastructure

• Audit all installed VIBs on ESXi hosts against known-good baselines
• Monitor for anomalous VMCI socket communications between ESXi hosts and guest VMs
• Check /etc/rc.local.d/ for unauthorized startup scripts on ESXi
• Monitor vCenter PostgreSQL for unusual database access patterns
• Watch for unexpected vmdird crashes or missing core dump files
• Verify VMware Tools version is 12.2.5 or later (patches CVE-2023-20867)

Juniper Routers

• Verify integrity of running processes against known-good baselines
• Monitor for unexpected suspended cat processes (Veriexec bypass indicator)
• Check for Base64-encoded files created via here documents
• Monitor UDP port 33512 for traffic containing 0xDEADBEEF magic values
• Watch for ICMP packets with non-standard payloads
• Audit all terminal server access to network devices

Linux Endpoints and VMs

• Inspect LD_PRELOAD environment variables system-wide for unexpected shared libraries
• Monitor for unexpected LKM loads (REPTILE kernel module)
• Check for executables at /usr/sbin/libvird and /usr/bin/NetworkManage (MEDUSA indicators — note deliberate misspellings)
• Look for files matching /var/log/ldapd*.2.gz (MEDUSA credential output)
• Check for /var/lib/libsyslog.so (LOOKOVER credential output)
• Audit yum-versionlock entries for frozen OpenSSH or suspicious packages
• Monitor for HTTPS traffic to *.github.io from infrastructure servers (MOPSLED dead-drop)
• Flag unexpected Google Drive API traffic from non-user-facing systems (RIFLESPINE C2)

The Bigger Picture: Three Groups, One Objective

The Singapore breach is not an isolated incident. It's part of a coordinated Chinese state campaign against global telecommunications infrastructure:

VISUAL: Three Groups Comparison

Three groups. Different tradecraft. Different immediate objectives. But all targeting telecommunications infrastructure, all operating in service of the same state, and all active in the same timeframe. China's intelligence apparatus views global telecommunications infrastructure as a strategic target of the highest priority.

Singapore's Minister Josephine Teo put the stakes bluntly: "If the attack went far enough, it could have allowed the attacker to one day cut off telecoms or internet services." The knock-on effects would cascade into banking, transport, and healthcare.

Key Takeaways

• Edge devices are the new frontline. Firewalls, routers, hypervisors, and VPN appliances are where nation-state actors operate because these devices often fall outside standard EDR coverage and generate limited telemetry. Extending monitoring to edge infrastructure at the firmware level closes a critical gap.
• Zero-day stockpiles are real. UNC3886 maintained weaponized zero-days across Fortinet, VMware, Juniper, and Ivanti products simultaneously. CVE-2023-34048 was exploited for two years before discovery. Assume that determined state actors have capabilities you haven't seen yet.
• Multi-layer persistence defeats single-layer remediation. UNC3886 deliberately maintains parallel access across network devices, hypervisors, and VMs. Cleaning one layer while the others remain compromised accomplishes nothing. Eviction must be simultaneous and comprehensive — which is why Singapore needed 100+ people and more than 11 months.
• Credential harvesting is industrialized. TACACS+ sniffing, SSH hooking, PAM interception, memory dumping, and database extraction all feed a continuous pipeline that sustains long-term access. Rotating credentials after a breach is essential but insufficient if the harvesting tools remain in place.
• VMCI is a detection blind spot. Hypervisor-to-VM communication via VMCI sockets is not visible to standard network monitoring. Organizations with VMware environments should add hypervisor-level integrity monitoring alongside network-level detection.
• The threat is coordinated at state level. Three Chinese groups targeting telecoms globally in the same timeframe — one for pre-positioning, one for signals intelligence, one for infrastructure access — represents a strategic national priority, not individual opportunism.

References

• CSA Singapore — Operation CYBER GUARDIAN Press Release (February 9, 2026)
• Minister Josephine Teo — Speech at Operation CYBER GUARDIAN Event (February 9, 2026)
• Mandiant — Cloaked and Covert: Uncovering UNC3886 Espionage Operations (June 2024)
• Mandiant — Fortinet Zero-Day and Custom Malware (March 2023)
• Mandiant — VMware ESXi Zero-Day Exploitation (June 2023)
• Mandiant — CVE-2023-34048 Exploited Since Late 2021 (January 2024)
• Mandiant — Ghost in the Router: UNC3886 Targets Juniper Routers (March 2025)
• MITRE ATT&CK — Group G1048: UNC3886
• The Record — Singapore attributes telecoms hacks to UNC3886 (February 2026)
• The Register — Singapore spent 11 months evicting suspected telco spies (February 2026)