Singapore’s cybersecurity paradox: Top firms rated A, yet all breached – Source: www.csoonline.com

“Every major company in Singapore is being impacted by risks they don’t directly control,” said Ryan Sherstobitoff, chief intelligence officer of SecurityScorecard’s STRIKE research unit. “As threat actors grow more sophisticated and supply chains more complex, cybersecurity resilience requires constant vigilance across all digital relationships—whether direct, third-party, or fourth-party. The cost of delay is simply too high.”

The research found that only 5% of the companies suffered a direct breach in the last year, most commonly through malware.

The fourth-party problem nobody saw coming

SecurityScorecard’s 2025 review found 100% of the top 100 firms having at least one compromised third-party provider in their digital supply chain. Despite Singapore boasting one of the lowest rates of poor internal cyber hygiene, just 4% had a C grade or below, these extended ecosystem breaches continue to hit hard.

Fourth-party risks come from vendors used by an organization’s suppliers, often unseen but just as critical. The MOVEit breach from 2023 made this clear, where a flaw in a file transfer tool used by third-party vendors led to widespread fallout, hitting companies with no direct link to the software. The incident showed how hidden supply chain gaps can cause very real damage.

“Cyber resilience isn’t a competitive edge anymore, it’s a business imperative,” Sherstobitoff said. “Accountability won’t be optional in 2025.”

Singapore faces targeted threats

Beyond statistical exposure, Singapore is also facing targeted campaigns against its critical infrastructure. One such operation involves China-linked threat group UNC3886, recently observed exploiting vulnerabilities in Juniper (Junos OS) routers to infiltrate telecom and service provider networks.

Gilad Maizles, threat researcher at SecurityScorecard, said, “The campaign appears to be operated through a China-nexus ORB network known as the GobRAT ORB.” Operational Relay Box (ORB) networks act as stealthy infrastructure layers, allowing attackers to relay malicious activity through a mesh of compromised systems, making the attacks persistent and evasive.

“The targeting of critical infrastructure in Singapore is a clear example of how China-aligned threat actors are shifting toward ORB-based infrastructure to obscure attribution and enable sustained access across high-value regional targets,” Maizles explains. He also noted the parallels with Volt Typhoon, a similar espionage campaign aimed at US infrastructure, suggesting a coordinated shift toward pre-positioning tactics.

To address these systemic risks, SecurityScorecard report recommends a shift from reactive assessments to proactive resilience metrics and workflows. These include mitigating fourth-party exposure through TPRM programs, integrating threat intelligence across ecosystems, mapping vendor risks and sketching supply chain incident response workflows, and implementing secure-by-design and hardening critical infrastructure through MFA and patch management.