Singapore’s critical infrastructure is under siege from UNC3886, a sophisticated China-linked APT group. They have been actively targeting essential services like energy, water, telecommunications, and government systems, exploiting zero-day vulnerabilities in widely used network and virtualization technologies. The group poses a severe risk to national security, potentially causing widespread disruptions if successful.

Singapore Hit by Mid-2025 Ransomware Surge, ThreatBook Report Reveals Singapore experienced a significant spike in ransomware attacks in 2025, with incidents peaking in July, according to ThreatBook’s 2025 Singapore Threat Intelligence Report. The technology and finance sectors were the hardest hit, though manufacturing and government entities also faced severe disruptions. The surge aligned with the exploitation of newly disclosed global software vulnerabilities, which threat actors leveraged to launch coordinated campaigns. Five ransomware groups dominated the landscape: Qilin, DireWolf, Lynx, DevMan, and Akira. Each employed distinct tactics while uniformly using double extortion encrypting systems and exfiltrating data to dark web leak sites for additional leverage. - Qilin targeted large enterprises, using Office macros and Cobalt Strike for initial access, then deploying credential-stealing tools and PowerShell scripts for lateral movement. - DireWolf focused on manufacturing and industrial systems, combining encryption with public data leaks to maximize pressure. - Lynx pursued high-value businesses across sectors, relying on phishing, malware downloads, and social engineering to steal data before encryption. - DevMan specialized in energy and industrial firms, encrypting files offline and deleting backups to cripple recovery efforts. - Akira operated across manufacturing, healthcare, blockchain, and transport, exploiting VPN vulnerabilities and phishing while using segmented encryption and multi-mode data theft. Common attack vectors included phishing emails, malicious documents, and exposed remote access tools like RDP and VPNs. Once inside, threat actors moved laterally using legitimate administrative tools such as SMB, PsExec, AnyDesk, and RustDesk, blending in with normal network activity to evade detection. The report underscores the growing sophistication of ransomware operations, with attackers increasingly tailoring their methods to specific industries.