UNC3886, Salt Typhoon, and Singapore’s telecom alert
Singapore’s government confirmed that UNC3886 — the China-linked group also tagged as Salt Typhoon — has been
probing the country’s four largest telcos (Singtel, StarHub, M1, and Simba Telecom) with advanced persistence
tools. The attackers gained footholds in under-monitored networks, installed rootkits, and moved laterally without
disrupting subscriber services.
According to the Government Technology Agency, the adversary accessed some critical systems but did not reach customer
data. Still, the breach proves that telecom control planes remain enticing for espionage: they sit on service
metadata, numbering plans, and the authentication backbone for both mass and enterprise communications.
Odido’s 6.2 million customer leak
Dutch telco Odido confirmed that hackers extracted 6.2 million customers’ names, contact details, IBANs, and passport/ID data after infiltrating a customer contact system. Odido says its network services remained up, but former customers whose service ended within the last two years are also listed in the stolen dataset. Importantly, Odido says the breach did not include call logs, billing files, or location data, which narrows the impact but still exposes IDs and payment information that can be abused by fraudsters.
Analysts tie this leak to a larger wave of telco-targeted espionage, especially the Salt Typhoon operations that have repeatedly targeted carriers across Norway, Canada, the US, and Singapore. The Odido attackers reportedly used a targeted intrusion in a CRM to siphon the customer data quietly over time.
Why telcos remain prime targets
- (1) Telcos hold customer identities, billing records, and, for enterprise clients, privileged VPN and MFA access.
- (2) Control-plane infrastructure often lacks layered segmentation, so a single foothold can yield broad visibility inside networks and even help stage future attacks on government or defense customers.
- (3) Regulatory notices around telco breaches can lag, creating months of quiet windows for reconnaissance and market advantage, which is what Salt Typhoon leverages in its “prepositioning” plays.
Defender posture
Telcos should treat CRM, ticketing, and onboarding portals as high-risk zones. Multi-factor protection needs to be standard on these apps, with privileged access reviewed monthly. Logging should capture unusual exports or downloads of customer data, especially when the request originates from a new IP range or from a workstation with no hardware-based identity token.
Global carriers are re-evaluating vendor risk for their partners’ CRM accounts. Do not expose contractor or support desks without narrow, ephemeral credentials and enforced logging.