An unknown threat actor appears to have taken nearly 69GB of sensitive data from the Philippine Overseas Employment Administration, including worker information, contracts, and financial records. Hunt.io said the material was copied from backup databases through a Singaporean staging server used in the breach, and the trail ended there.
Data moved through a staging server
Hunt.io’s Oct. 28 analysis said the attacker copied 27 backup databases in 24 minutes. The databases contained overseas-employment case management records, including accreditation, contracts, and cashier and LandBank records. The firm said the attacker used GodPotato and SeImpersonate for privilege escalation and the Impacket Python network library to move the data.
The server was later accessed, but Borges said it was unclear by whom. Hunt.io has not found the data advertised for sale, and Borges said the information may have been detected and removed, although that seems unlikely. He also said he would not claim the backups stopped on the staging server, and the transfer log still shows the data leaving the agency’s control.
What Hunt.io could and could not confirm
Hunt.io treated the incident as a confirmed compromise, but the lack of runtime telemetry left gaps in the investigation. Borges said the firm still could not answer how the attacker got in, whether the payload ran, or where the data went. The open directory on the Singaporean address space of UpCloud Ltd. contained tools and log files tied to the attack, including a rebranded GodPotato library, a PowerShell stager that unpacked tools in memory, and the full Impacket Python environment.
Borges described the operator as technically capable but careless. He said the payload engineering was competent, while operational security was poor because the staging server and its logs were left open. He did not call the actor top-tier or amateur.
Possible uses for the stolen records
Hunt.io said it has not attributed the hack to China or to cybercriminal groups. It found some Chinese-language fragments in the code, but those fragments were part of a third-party library. The company said both cybercriminals and nation-state adversaries would see value in the personally identifiable information.
Borges said migrant-worker PII, together with contract and payment data, could support fraud and identity theft. He added that the same material could also map a diaspora population, which may interest a state actor.
Earlier signs and current exposure
Hunt.io said the latest insight came after researchers found an open directory on a server hosted in Singaporean address space by Helsinki-based UpCloud Ltd. The directory exposed tools and logs from the operation. The company had also seen another Philippine government-linked theft in August, when it found 1.2GB of data from a Philippine nuclear regulatory agency and a maritime shipbuilding contractor on another threat actor’s workspace.
A year ago, Philippine police arrested the mayor of a small town after discovering she was a Chinese national posing as a Filipina citizen and running a cyber-scam center. Borges said the current incident could not be tied to China or cybercriminal groups on the evidence Hunt.io had gathered.
Agency notice and exposed ports
Hunt.io notified CERT Philippines, also known as CERT-PH, and the Department of Migrant Workers, or DMW. The company did not share more detail about the national response. Borges said the data had not appeared for sale on the Dark Web, and Hunt.io never opened the backups themselves.
The firm also said governments in the region need to scan their own networks and reduce their attack surface. It said workers with too many privileges can give attackers more access when tools such as SeImpersonate are available, and it found risky ports on the migrant-worker portal, including SMB on 445 and WinRM on 5985 and 47001.
Licensed under CC BY-ND 4.0 International