Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach
An unknown operator appears to have exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under a half hour.
An unknown operator appears to have exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under a half hour.
An unknown threat actor managed to gain access to sensitive databases belonging to the Philippine Overseas Employment Administration, exfiltrating nearly 69GB of information on workers, contracts, and financial records, according to an analysis of a staging server used in the breach.
Over 24 minutes, the attacker copied 27 backup databases with information on overseas-employment case management, including accreditation, contracts, and cashier and LandBank records, according to threat intelligence firm Hunt.io’s Oct. 28 analysis of the logs found on a Singaporean staging server used by the attacker. The cyberattackers used privileged escalation tools, namely GodPotato and SeImpersonate, and the Impacket network library for Python to move the data, but the trail stopped at the staging server, says Esteban Borges, head of research for Hunt.io.
The server had been later accessed, but by who is not clear, Borges says. While Hunt.io has not yet discovered the data as advertised for sale, the information may have been detected and removed, but that seems unlikely, he says.
“I won’t claim the backups stopped on the staging server,” he says, so it’s “still a breach, since the data was copied out of the agency’s control and the log shows the transfer completing.”
This is not the first time that cybersecurity firms have found evidence that Philippine government data had been stolen. In August, Hunt.io discovered another threat actor’s workspace hosting a number of tools and, in that case, 1.2GB of data stolen from a Philippine nuclear regulatory agency and a maritime shipbuilding contractor. A year ago, Philippine police arrested the mayor of a small town after discovering she was a Chinese national posing as a Filipina citizen and operating a cyber-scam center.
Whether the current incident involved China or cybercriminal groups is not clear. While Hunt.io did find some Chinese language fragments in the parts of the code, that code belonged to a third-party software library; thus, Hunt.io did not attribute the hack. The company did say, however, that both cybercriminals and nation-state adversaries would find value in the personally identifiable information (PII).
“That kind of migrant-worker PII, plus contract and payment data, is useful for fraud and identity theft, so it has commercial value,” Borges says. “It’s also a detailed map of a diaspora population, which can interest a state actor.”
Not Top-Notch, Not Amateur
The latest insight into attacks on the Philippine government came after Hunt.io researchers discovered an open directory on a server hosted on the Singaporean address space of a Helsinki-based firm UpCloud Ltd., the analysis stated. The open directory contained tools and logs files for the attack, including a rebranded version of the GodPotato privilege escalation library, a PowerShell stager to unpack tools in memory, and the full Impacket Python environment.
While Hunt.io considered the incident a confirmed compromise, the lack of runtime telemetry meant that Borges could not answer where the attacker moved the data.
“[W]e still can’t answer … how they got in, whether the payload ran, and where the data went,” he says.
However, the tools and the attacker’s process indicated an operator with some strong ability, but who also made some simple mistakes, Borges says.
“The payload engineering is competent, [but] the operational security is poor — they left the staging server and its logs wide open,” he says. “[It was] someone who can build the tool properly but was careless about keeping their own server quiet. I wouldn’t call that top-tier or amateur.”
Philippine Worker Data Up in the Air
The impact of the breach may boil down to the identity of the attacker and what they do with the stolen data. While Hunt.io notified the CERT Philippines (CERT-PH) and the Department of Migrant Workers (DMW), the company declined to provide any more details of the national responses to the leak.
However, Borges did say that, so far, the information has not appeared for sale on the Dark Web.
“We haven’t seen the backups surface for sale or in a leak,” he says. “We never opened the backups themselves.”
Governments in the region need to scan their own networks and lock down their attack surface area, he says. Workers with too many privileges allow attackers with tools such as SeImpersonate to gain more access to assets on the network. Hunt.io also found that the migrant-worker portal exposed a number of risky ports, including SMB on 445 and WinRM on 5985 and 47001.
Read more about:
