Singapore first disclosed in July 2025 that UNC3886 was attacking its critical infrastructure. According to its Cyber Security Agency (CSA), the attackers gained limited access to critical systems but “did not get far enough to have been able to disrupt services.”
Why It Matters
The firewall was the way in
Perimeter firewalls face the internet by design, so anyone scanning for them can find them. Mandiant describes UNC3886 as a group that "has historically targeted network devices and virtualization technologies with zero-day exploits," with interests focused on defense, technology and telecom organizations in the US and Asia.
Patching cannot close a flaw nobody knows about yet. What an operator can control is how much of its network an outsider can see and reach.
Why blocking by address falls behind
China-nexus groups increasingly route attacks through operational relay box (ORB) networks: These are compromised routers, IoT devices, and leased servers, often end of life, that make attack traffic harder to trace back to the attacker.
UNC3886 has used this cover before. In a March 2025 report, Mandiant described backdoors on end-of-life Juniper routers, with one set of command servers believed to be staging nodes of an ORB network. Team Cymru notes those indicators were located in Singapore. Team Cymru also counted up to 42 ORB addresses communicating with the four operators' networks in a 30-day window.
These addresses do not last. Mandiant found an address can stay in an ORB network for as few as 31 days and warns that "IOC extinction is accelerating." Blocklists still have a place against known infrastructure. Against infrastructure that changes monthly, they fall behind.
What changes with Entropya
Singapore's case started with a device the internet could see. Entropya's HIDE. HARDEN. VERIFY approach starts in the same place, by reducing what an outsider can find before protecting and verifying everything that remains. HIDE uses Digital Camouflage to keep infrastructure out of public view, HARDEN applies post-quantum cryptography (PQC) to protect traffic, and VERIFY authenticates every session.
Entropya Encrypted Network (EEN) is infrastructure agnostic. It deploys on premises or in the cloud and runs over any internet connection. An Iron Edge Gateway (IEG) at the internet-facing edge authenticates systems into the EEN. If a firewall is retained in the architecture, the IEG complements it by making sure only authenticated sessions reach it. Because EEN operates at Layers 2 and 3 of the Open Systems Interconnection (OSI) model, everything above them works as before, now protected by Entropya.
“The client's systems continue to operate normally, but it becomes much more difficult to use open-source intelligence, network analytics, or pattern-of-life analysis against their infrastructure.”
Mr. Purta, Co-Founder and CEO, Entropya
Questions to ask your team
- Which of our firewalls, VPN gateways and routers can be reached from the internet, and which run end-of-life software?
- If one of them had an unknown flaw today, what could an attacker reach behind it?
- Do we analyze flow data for traffic from residential and small-office relay addresses?
- How much of our blocking relies on IP reputation, and how current is it?
Frequently Asked Questions
On February 9, 2026, Singapore's Cyber Security Agency disclosed that UNC3886 had targeted M1, SIMBA Telecom, Singtel and StarHub. The group used a zero-day exploit to bypass a perimeter firewall, used rootkits to stay hidden, and took a small amount of technical data believed to be mainly network-related. CSA found no evidence that customer records were accessed or services disrupted.
An operational relay box (ORB) network is a mix of compromised routers, IoT devices and leased servers that attackers use to relay their traffic, so attacks appear to come from ordinary home or business connections. Addresses change often: Mandiant found an address can stay in an ORB network for as few as 31 days, which makes IP blocklists go stale quickly.
Begin with internet-facing firewalls, VPN gateways and routers, especially those running end-of-life software. Reduce what those devices reveal, limit what a compromised device can reach, and treat IP blocklists as one layer of defense. Architectures that keep infrastructure out of public view make networks much harder to map and target.