Singapore refreshes cyber strategy with new measure to block malware and phishing sites
Source: Straits Times
Article Date: 14 Oct 2026
Author: Kenny Chee
Updated cyberstrategy needed as threat actors becoming faster, more sophisticated due to AI.
The authorities will soon block Singapore users from accessing known phishing and malware sites amid a sharp rise in the number of infected computer systems here.
The new measure, called a protective domain name service (PDNS), was announced on Oct 13 by Senior Minister K. Shanmugam as part of Singapore’s refreshed cybersecurity strategy to counter heightened cyberthreats.
The shift is towards a proactive, AI-driven national defence model, as threat actors have become faster and more sophisticated, thanks to artificial intelligence.
“Singapore will seek to act earlier, act at national scale and act at the speed of the threat. This shift is an important part of Singapore’s cybersecurity strategy 2026, which we are launching today,” said Shanmugam, who is Coordinating Minister for National Security and Minister for Home Affairs.
He was speaking at the opening of the 11th Singapore International Cyber Week at Marina Bay Sands Expo and Convention Centre.
Shanmugam said Singapore’s updated cybersecurity strategy is broader than how national cyberdefence has been built so far.
“It will cover how we will strengthen our critical infrastructure in the wider cyberspace, build capabilities for AI and quantum, deepen our global partnerships, and invest in our cybersecurity ecosystem and workforce,” he said.
Expected to be rolled out in 2027, PDNS will be operated by the Cyber Security Agency of Singapore’s (CSA) National Cybersecurity Command Centre, under the Online Criminal Harms Act.
The Act, which came into force in 2024, allows the authorities to ask individuals, companies and internet service providers to remove or block access to content that they suspect is being used to commit crimes, such as illegal gambling and moneylending, drug-related offences, scams, and malicious cyberactivities.
CSA said the new measure will have safeguards to “ensure the responsible exercise” of powers under the Online Criminal Harms Act.
The agency said a “robust assessment and validation process” will be carried out before malicious websites are blocked, to reduce the risk of false positives and to ensure site blocking decisions can be accounted for.
Individuals or organisations affected by the blocking can seek recourse through the Act’s existing reconsideration and appeal processes.
Similar services to block malicious websites have been implemented in Australia, Canada, the European Union, Britain and the United States.
In 2022, an inter-agency Counter Ransomware Task Force in Singapore recommended the use of PDNS as a form of “upstream defence” to prevent known malicious attackers from reaching internet users here.
This is because such attackers can trick users into downloading malware from malicious sites that can steal users’ company data or lock it up until a ransom is paid.
It is becoming more difficult to safely navigate cyberspace. According to CSA’s latest Singapore Cyber Landscape report published in June, the number of malware-infected computer systems detected in Singapore more than doubled from 117,300 in 2024 to 284,300 in 2025.
“Singapore must raise the level of cybersecurity across our entire ecosystem,” said CSA on Oct 13, adding that such upstream protection is one of the key thrusts of the country’s refreshed cybersecurity strategy to counter more frequent and advanced threats.
The other pillars of the national strategy are: defending critical infrastructure; strengthening capabilities for AI and quantum technologies; and improving resilience through global partnerships.
Computer systems of critical infrastructure, or critical information infrastructure like those for power plants and telecommunications, are being increasingly targeted by hackers behind advanced cyberattacks that can stay undetected for long periods of time. These attackers are also called advanced persistent threat actors.
An attack in Singapore by one such group of hackers was revealed in July 2025. The country’s four major telcos were attacked by state-sponsored cyberespionage group UNC3886. The attack could have disrupted telecommunications and internet services had the group infiltrated further.
Other new safety measures under Singapore’s updated cybersecurity strategy include exploring cyberinsurance pilots, as well as the launch of a new police Cyber Command unit in July to target scammers and cybercriminals before they reach Singaporeans.
Referring to the National Cybersecurity Command Centre, which was established in 2025, CSA said: “The intensified threat landscape underpins the need for a command centre with enhanced national capabilities to detect cyber risks earlier and accelerate operational responses.”
The centre detects and neutralises cyberthreats before they reach Singapore’s shores.
Besides operating the PDNS, the centre will also allow cyberdefenders of critical information infrastructure to combine threat intelligence from various sources to facilitate the coordination of cyberoperations at a national level.
Shanmugam said that Singapore must act on a national scale, citing important lessons the country learnt from Operate Cyber Guardian, the nation’s largest coordinated defence, which was launched following the UNC3886 attack on the four telcos.
“A sophisticated attacker does not see the Government and telcos as separate,” he said. “They look across the system and look for the weak point. Our national defence has to look across the system, too. Government and industry have to work closely together in our response.”
Cyberdefenders of critical information infrastructure will also be able to detect malicious activities, especially those of advanced persistent threat actors, with new proprietary threat detection systems developed by the Ministry of Defence’s Centre for Strategic Infocomm Technologies.
The ministry’s centre is working with CSA to equip selected infrastructure owners with the systems.
CSA’s National Cybersecurity Command Centre will alert the defenders when it detects malicious network activity picked up by the threat detection systems.
Shanmugam said that with such detection, the country can act earlier, before threat actors cause serious harm.
“Adversaries are continuously looking for vulnerabilities and trying to establish persistent access,” said the senior minister.
“Our defence, therefore, has to be continuous. We need to consistently monitor and hunt for threats, identifying weaknesses before adversaries do so, and correcting them quickly.”
Separate systems will also be deployed that use AI to track ongoing incidents and help cyberdefenders to develop operational assessments and plan their next actions. This will allow the National Cybersecurity Command Centre to coordinate faster responses to cyberincidents.
Wider adoption of AI and migration to quantum-safe systems are also part of Singapore’s refreshed strategy to strengthen protection.
Attackers are using AI tools to strike faster and at greater scale, while advancements in quantum computing threaten to undermine methods used today to encrypt data.
Shanmugam said that if AI lets attackers identify vulnerabilities and conduct attacks faster, cyberdefenders must also use AI.
“The Government will progressively deploy AI across our national cyberdefence operations,” he said, adding that this includes CSA’s National Cybersecurity Command Centre and the Government Technology Agency of Singapore’s Government Cyber Security Operations Centre.
“We will also work with industry and technology partners to speed up adoption of AI-enabled cyberdefence capabilities across our critical sectors.”
Neville Vincent, cybersecurity firm Trellix’s senior vice-president and general manager for Asia-Pacific, Japan and Greater China, said the national PDNS could provide a useful safety net for people in Singapore.
“Before your phone or computer connects to a website, it looks up the website’s internet address. PDNS checks that lookup – also called a DNS request – and can block the connection if the destination is known to be dangerous,” he said. “So, even if someone clicks a convincing phishing link, it could stop the fake website from loading.”
The PDNS experience overseas gives an idea of how the service could work, but they point to blocked requests, not the prevention of actual attacks, said Vincent.
For example, Britain’s National Cyber Security Centre reported blocking 11 billion DNS requests involving 420,000 domains in 2022. Australia’s government-focused service blocked more than 67 million malicious domain requests for the 2022 to 2023 financial year.
The effectiveness of Singapore’s PDNS will depend on timely information about malicious sites and attacker activity, and how widely the service covers internet traffic, said Vincent.
“New scam sites may get through before they are identified, so an unblocked website is not necessarily safe,” he added.
Source: The Straits Times © SPH Media Limited. Permission required for reproduction.
1