An unknown threat actor exploited an entry into the Philippine Overseas Employment Administration’s sensitive databases, exfiltrating nearly 69GB of information on workers, contracts, and financial records This article explores evidence stolen philippine. . For over 24 minutes, the attacker transferred 27 backup databases containing information related to overseas employment cases, including accreditation, contracts, and LandBank records, according to a report from threat intelligence firm Hunt.io, which analyzed logs found on a Singaporean staging server used by the attacker.
The cybercriminals employed privileged escalation tools such as GodPotato and SeImpersonate, along with the Impacket network library for Python, to move the data, but the trail ended at the staging server, as reported by Esteban Borges, head of research for Hunt.io.
He adds, "I won't claim that the backups stopped on the staging server, so it's still a breach since the data was transferred out of agency control and the log shows the transfer completed." This is not the first time that cybersecurity firms have uncovered evidence of stolen Philippine government data.
The unsecured directory contained tools and logs files for the attack, including a rebranded version of the GodPotato privilege escalation library, a PowerShell stager to unpack tools in memory, and the full Impacket Python environment. Hunt.io discovered that the migrant-worker portal exposed several risky ports, including SMB on port 445 and WinRM on ports 5985 and 47001.
