Just days away from its 60th National Day celebrations, Singapore raised its cyberthreat alert level. Cybersecurity experts share their perspectives with CybersecAsia.
At the Operational Technology Cybersecurity Expert Panel (OTCEP) Forum on 29 July 2025, Singapore’s Minister for Digital Development and Information Josephine Teo announced new regulations, which take effect later this year, as Singapore raised its cyberthreat alert level in the face of ongoing UNC3886 attacks on the nation’s critical infrastructure.
After Coordinating Minister for National Security K Shanmugam said the nation is actively dealing with a highly sophisticated threat actor attacking its critical infrastructure, Singapore’s Cyber Security Agency (CSA) announced in a statement that it was leading the investigations, and is working closely with relevant agencies and partners to support affected organizations.
“In addition, we are monitoring all critical sectors and sharing threat intelligence so that they can take preventive measures,” the statement said. The new regulations to come into force include requiring all critical information infrastructure (CII) owners to report their advanced persistent threat (APT) incidents to CSA.
“Given the UNC3886 attack and heightened APT activity, it should not come as a surprise to anyone that we are currently in a heightened state of alert,” said Minister Teo.
Cybersecurity experts in the region weigh in on the developments….
Paul Wilcox, VP, APJ, Infoblox:

UNC3886 is a good example of how today’s threat actors are playing the long game — embedding themselves in critical infrastructure to quietly disrupt essential services, supply chains and everyday life.
With Singapore now requiring all CII owners to report their APT incidents, there’s a growing recognition that these threats are already happening. But, detection after the fact is too late. Enterprises need to stay one step ahead with preemptive tools that surface threats before damage is done.
APT groups often slip past traditional tools, which is why broader visibility is needed. DNS, as the layer that underpins every internet connection, is often an overlooked but invaluable tool in pre-emptively stopping attacks. With the right defences, 82% of domain-based threats can be stopped before they reach the network.
DNS is often a blind spot, but it doesn’t have to be. Early detection gives security teams a head start, before attackers gain ground.
Ian Farquhar, Security CTO, Gigamon:

The recent UNC3886 infiltration into Singapore’s critical infrastructure is a stark reminder that even the most secure nations are targets for today’s sophisticated threat actors.
These adversaries don’t smash through the front door; they operate with stealth, moving laterally within networks and hiding their activity in encrypted traffic that most security tools cannot inspect.
This is precisely why deep observability is no longer optional. Organizations must illuminate every corner of their digital environment, especially encrypted and lateral traffic where attackers often hide. Without it, defenders are effectively flying blind.
Ultimately, achieving pervasive visibility into all data in motion is the only way to counter these elusive threats. In an age where APTs evolve faster than perimeter defenses, it’s not just about building taller walls; it’s about shedding light on the entire battlefield. Only then can we meaningfully accelerate detection and outpace the adversary.
David Ng, Managing Director, Singapore, Philippines & Indonesia, Trend Micro:

The rise of APTs like UNC3886 and Earth Kurma highlights a critical reality for Southeast Asia: passive, “wait-for-a-breach” security no longer works. Singapore’s recent regulations also emphasize the need for a more proactive approach to cybersecurity.
Enterprises need to empower their security teams to identify vulnerabilities, prioritize threats by business impact, and implement mitigation strategies before attacks occur. Cyber Risk Exposure Management (CREM) enables this shift by going beyond simply visualizing risk.
When combined with a unified cybersecurity platform designed for real-time risk visualization, management, and automation, organizations gain enhanced visibility while streamlining response efforts to more effectively safeguard digital assets in today’s dynamic threat landscape.
For stealthy APTs, which often lurk undetected and move laterally through networks, CREM acts as an early warning system and risk-reduction engine. With a continuous and dynamic view of cyber exposure, it helps organizations stay ahead and ultimately build a more resilient cybersecurity posture.
Sanjay Yadave, Vice President & Managing Director, Greater Asia, Zscaler:

State-linked threat actors are stealthy and persistent, often bypassing traditional defenses and remaining undetected for long periods. Zscaler’s ThreatLabz recently uncovered two China-nexus campaigns that used legitimate websites and multi-stage infection chains to target vulnerable communities, illustrating how difficult it can be to identify and respond to such threats once they’ve taken hold.
Singapore’s new regulations are a necessary step toward improving national cyber readiness—given how advanced persistent threats operate, regulation and security must work hand in hand.
Timely reporting helps surface threats, but it only works if organizations have the tools to detect, contain, and neutralize them early. That means inspecting encrypted traffic at scale, identifying zero-day threats in real time, and limiting lateral movement through zero trust controls.
With threats evolving faster than ever, true resilience requires close collaboration between the public and private sectors — ensuring that policy, technology, and threat intelligence evolve together to stay ahead of increasingly sophisticated attacks.