Singapore Reports Cyber Espionage Group Targeted Telcos

Singapore's cybersecurity agency reported a state-linked espionage group targeted its telecom infrastructure, aiming to steal data and gain persistent access.

The Cyber Security Agency of Singapore (CSA) has issued a detailed advisory confirming that a sophisticated, state-linked cyber espionage group conducted a sustained campaign targeting the country’s telecommunications infrastructure. According to the report, the threat actors, identified by the alias "Velvet Chameleon," employed advanced techniques to infiltrate networks, steal sensitive data, and establish long-term persistence within telecom systems.

The campaign, which was detected and mitigated in late 2025, primarily sought access to carrier networks, subscriber databases, and critical network operations systems. The attackers utilized a combination of spear-phishing, exploitation of unpatched vulnerabilities in network appliances, and custom malware designed to evade traditional detection. The CSA stated that the group's tactics, techniques, and procedures (TTPs) align with those of a known advanced persistent threat (APT) group believed to operate in the interests of a foreign state.

“This was not a random attack but a deliberate, calculated operation aimed at espionage and potentially prepositioning for future disruptive activity,” a senior CSA official stated. The agency worked closely with affected telecommunications providers to contain the breach, conduct forensic investigations, and deploy enhanced monitoring. No significant disruption to consumer services was reported, as the focus appeared to be on stealth and data exfiltration.

The advisory includes technical indicators of compromise (IOCs) and mitigation strategies, urging all critical infrastructure operators, especially in the telecom and technology sectors, to review their defenses. Regional cybersecurity firms have noted that this campaign mirrors similar activities detected in other Southeast Asian nations, suggesting a broader regional espionage effort targeting communication hubs.

This disclosure underscores Singapore's role as a high-value intelligence target due to its status as a global financial and data transit hub. It also highlights the increasing trend of nation-states targeting civilian telecommunications infrastructure to gather intelligence, monitor dissidents, or gain strategic leverage.