cyber.hendryadrian.com
Threat Research · team-cymru.com

Team Cymru Maps ORB Activity Around Singapore Telecom Networks

· Original article ↗

Summary

Team Cymru used Scout and NetFlow queries to identify ORB nodes and communications involving Singapore telecom networks, contextualizing the findings with CSA’s account of UNC3886’s campaign and Singapore’s router-security rules.

Key points

  • Singapore’s CSA said UNC3886 targeted M1, SIMBA Telecom, Singtel, and StarHub. The campaign reportedly used a zero-day to bypass a perimeter firewall, and a small amount of technical data was reportedly exfiltrated.
  • Team Cymru identified up to 44 unique IPs tagged as ORBs in Singapore over 90 days, including up to 12 associated with the four named telecom operators.
  • NetFlow queries found up to 42 ORB IPs communicating with the operators’ IPs and up to 62 operator IPs communicating with ORBs over 30 days; Team Cymru tagged most of the latter as D-Link or Asus routers.
  • Team Cymru’s analysis connects the ORB findings to UNC3886 activity and lists three GOBRAT C2 IPs in Singapore, last seen between December 28, 2025, and February 11, 2026.
  • Singapore requires locally sold residential gateways to meet security requirements, including timely security updates; its Cybersecurity Labelling Scheme requires at least Level 1 for routers.
  • The article identifies potential gaps for older routers predating the requirements and devices imported directly from overseas.

Article Details

Attack Vectors
  • UNC3886 reportedly exploited a zero-day vulnerability in a perimeter firewall to gain access to Singaporean telecommunications networks.
  • The campaign used rootkits to evade basic detection systems.
  • ORB networks route attacker traffic through compromised IoT devices, SOHO routers, and VPS infrastructure to obscure its origin and support reconnaissance and access.
Defensive Notes
  • Improve visibility into adversary infrastructure and identify compromised SOHO routers and IoT devices.
  • Apply router security updates and replace or address legacy devices that lack automated protections.
  • Singapore’s TS RG-SEC requires security patches for residential gateways sold locally; its Cybersecurity Labelling Scheme requires at least Level 1 for routers sold in Singapore. The article notes that older and directly imported devices may fall outside these protections.

Indicators of compromise

TypeIndicatorContext
IPV4101[.]100[.]182[.]122Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.
IPV4116[.]88[.]34[.]184Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.
IPV4118[.]189[.]188[.]122Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.
IPV4129[.]126[.]109[.]50Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.
IPV4158[.]140[.]135[.]244Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.
IPV4223[.]25[.]78[.]136Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.
IPV445[.]77[.]39[.]28Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.
IPV447[.]82[.]7[.]142Identified by Team Cymru as a GOBRAT C2 server.
IPV48[.]218[.]127[.]103Identified by Team Cymru as a GOBRAT C2 server.
IPV48[.]218[.]212[.]173Identified by Team Cymru as a GOBRAT C2 server.
IPV48[.]222[.]225[.]8Listed as TinyShell C2 infrastructure associated with the reported UNC3886 activity.

MITRE ATT&CK

T1014 · RootkitThe article reports that UNC3886 used rootkits to evade basic detection systems.T1090 · ProxyORB networks relayed attacker traffic through compromised devices and servers to obscure its origin.T1190 · Exploit Public-Facing ApplicationUNC3886 reportedly exploited a zero-day in a perimeter firewall to gain access to telecommunications networks.

Threat Actors

UNC3886The CSA reported that UNC3886 targeted Singapore’s telecommunications sector, and Mandiant describes the group as tied to Chinese cyber-espionage operations.

Malware

GobRATTable 1 below. Notably, Mandiant’s researchers also noted that these IPs are staging nodes used by the GOBRAT ORB network.

Vendors

Team Cymru(IoT) devices, Small Office/Home Office (SOHO) routers, and Virtual Private Servers (VPS). Team Cymru has blogged previously about ORBS here.

Tools

Team Cymru Scout  Table 1. UNC3886 IOCs shared by Mandiant enriched by Team Cymru Scout.

Countries

SingaporeOn February 9, 2026, the Cyber Security Agency of Singapore (CSA) released a press release detailing a multi-agency cybersecurity operation, codenamed Operation CYBER GUARDIAN, intended to defend their communications

Industries

EnergyIts targets span energy, water, telecommunications, finance, and government services, with tactics that include custom malware and advanced persistence techniques. UNC3886 has reportedly used zero-days in Fortinet,financeIts targets span energy, water, telecommunications, finance, and government services, with tactics that include custom malware and advanced persistence techniques. UNC3886 has reportedly used zero-days in Fortinet,Government servicesIts targets span energy, water, telecommunications, finance, and government services, with tactics that include custom malware and advanced persistence techniques. UNC3886 has reportedly used zero-days in Fortinet,Telecommunicationsthat UNC3886 had launched a deliberate, targeted, and well-planned campaign against Singapore’s telecommunications sector. All four of Singapore’s major telecommunications operators—M1, SIMBA Telecom, Singtel,waterIts targets span energy, water, telecommunications, finance, and government services, with tactics that include custom malware and advanced persistence techniques. UNC3886 has reportedly used zero-days in Fortinet,

Related Articles