Singapore’s Coordinating Minister for National Security and Minister for Home Affairs K Shanmugam has reiterated that naming any specific country linked to the cyber threat group UNC3886 is not in Singapore’s interest for now.
On 1 August 2025, speaking at the Cyber Security Agency of Singapore’s (CSA) Exercise Cyber Star, Shanmugam explained the government’s position on handling sensitive attribution for cyber attacks.
Shanmugam said, “When it comes to naming any country responsible for a cyber attack, we always think about it very carefully.”
His remarks followed media queries about reports suggesting that UNC3886 may be linked to China.
Shanmugam noted that while industry experts and media outlets have pointed to a possible China connection, the Singapore government would not comment on such allegations.
He said, “Media coverage and industry experts all attribute UNC3886 to some country. Government does not comment on this. ”
“We release information that we assess is in the public interest. Naming a specific country is not in our interest at this point in time.”
Cybersecurity firm labelling UNC3886 “China-nexus espionage group”
Cybersecurity firm Mandiant, owned by Google, has described UNC3886 as a “China-nexus espionage group”.
Mandiant claims the group has targeted strategic organisations around the world.
On 18 July 2025, Shanmugam announced that Singapore was facing a sophisticated cyber threat from UNC3886, which he described as a “highly sophisticated threat actor”.
However, he did not clarify whether the group is state-linked.
Shanmugam warned that UNC3886 poses a serious danger to Singapore’s national security and that revealing more details could risk undermining security efforts.
The following day, when asked about possible retaliation if Singapore were to name a country linked to UNC3886, Shanmugam said such scenarios were “speculative”.
At the time, he said, “What Mandiant does is what Mandiant does. As far as the Singapore Government is concerned, we can say we are confident that it is this particular organisation. ”
“Who they are linked to, and how they operate, is not something I want to go into, ” added Shanmugam.
China rebukes Singapore media over reports linking cyber group UNC3886 to Beijing
In response to reports connecting UNC3886 to China, the Chinese embassy in Singapore issued a statement on Facebook on 19 July 2025.
The embassy voiced “strong dissatisfaction” with the allegations and labelled them “groundless smears and accusations against China”.
The statement read, “In fact, China is a major victim of cyberattacks.”
“The embassy would like to reiterate that China is firmly against and cracks down on all forms of cyberattacks in accordance with law. China does not encourage, support or condone hacking activities.”
Shanmugam also addressed why the government decided to reveal the identity of UNC3886 despite withholding attribution to any country.
He explained, “We look at the facts of each case and the degree of confidence we have before we can name. And when we decide to name the threat actor, we look at whether it is in Singapore’s best interest.”
In this case, the severity of the attack and the compromise of Singapore’s infrastructure justified naming the group publicly.
Shanmugam said, “Here, we said this is serious. They have gotten in. They are compromising a very serious critical infrastructure. Singaporeans ought to know about it, and awareness has got to increase. And because of the seriousness, it is in the public interest for us to disclose.”
Exercise Cyber Star, where Shanmugam made these remarks, is Singapore’s key national cybersecurity crisis management drill, coordinated by the CSA.
The government continues to monitor the situation and has not ruled out releasing more information if it becomes necessary to safeguard national interests.
The post Shanmugam says naming country behind UNC3886 cyber threat not in Singapore’s interest for now appeared first on The Online Citizen.
