Philippines Pummeled by Assortment of Cyberattacks & Misinformation Tied to China

The volume of malicious cyber activity against the Philippines quadrupled in the first quarter of 2024 compared to the same period in 2023.

A recent massive spike in cyber misinformation and hacking campaigns against the Philippines coincides with rising tensions between the country and its superpower neighbor China.
The cyberattacks consist of a combination of hack and leak (55%), distributed denial-of-service (10%), and misinformation and influence campaigns (35%), according to researchers at Resecurity who have been following the campaigns. The main targets are government (80%) and educational institutions (20%) in the Philippines, and these attacks — on police agencies, government ministries, and universities — and associated data leaks are sowing discontent in the country, according to the researchers.
This represents a four-fold (325%) increase in what the researchers identify as malicious cyber-espionage activity targeting the Philippines in the first quarter of 2024 compared to the same period last year. The goal of this activity is to discredit the government and create chaos via cyberspace, as the Philippine population also relies on digital media channels and is active on social media networks, says Shawn Loveland, COO of Resecurity.
Resecurity has worked with authorities in the Philippines to trace back the source of attacks to online infrastructures in China and Vietnam. These false flag and other territories could be allies of China in such campaigns or provide them infrastructure for it, according to Resecurity.
The goal of the cyberattacks correlates with disinformation campaigns spinning Chinese narratives on topics such as regional disputes about territories in the South China Sea.
In a
blog post
this month, Resecurity detailed the myriad of different groups associated with this collective activity. In one notable attack, a threat actor going by the alias KryptonZambie claimed to have obtained from unnamed sources over 152 gigabytes of stolen data containing Philippine citizen identity cards. Resecurity investigated this claim, which related to a post on Breach Forums, a Dark Web site, but found it unsubstantiated. The threat actor did not respond to any messages Resecurity investigators sent to a Telegram account used to publicize the supposed breach.
Other elements of the campaign involved posting an audio deepfake of Philippine President Ferdinand Marcos Jr. supposedly ordering military action against China.
No such directive exists
, according to authorities in the Philippines.
It’s not all fakery, however. Several of the groups covered by Resecuritys report — including Philippines Exodus Security and DeathNote Hackers — ran attacks that led to a confirmed data breach.
While some of this activity might resemble that of hactivists, Resecurity believes nation state-backed hackers from China or possibly North Korea (another regional adversary to the Philippines) are really to blame.
Resecurity has reported over 12 government organizations in the Philippines being targeted in the same timeframe — hallmarks of a well-organised co-ordinated attack by nation-state actors rather than independent hacktivists.
Leveraging hacktivist-related monikers allows threat actors to avoid attribution while creating the perception of homegrown social conflict online, according to Resecurity.
Last year a Chinese state-linked advanced persistent threat (APT) group known as
Mustang Panda hacked
a Philippine government target via a simple side-loading technique. This group has a strong focus on Philippines and [is] still active, according to Resecurity. Hacks by the group on Philippine government entities have been actively promoted via social media.
In April 2023, more than 800 gigabytes of both applicant and employee records from multiple state agencies — including the Philippine National Police (PNP), National Bureau of Investigation (NBI), Bureau of Internal Revenue (BIR), and Special Action Force (SAF) — were compromised.
This was followed in September by a breach and ransomware attack on the Philippine Health Insurance Corporation (PhilHealth) that led to the exposure of hospital bills, internal memos, and identification documents. There remains an ongoing investigation into the full extent of the leak, according to cyber threat detection firm Gatewatcher.
China (and to a lesser extent North Korea) is the prime suspect in much of this malfeasance, according to both Resecurity and other threat intel experts.
China is a far more complex and nuanced territory than generally portrayed. Its internal pressures are likely to lead to increased cyber-espionage activity, rather than slowing it down, says Ian Thornton-Trump, CISO at threat intel firm Cyjax.
The PRCs approach to cyberspace has always been to use it to advance its business interests, extracting technologies from Western companies and creating a protected domestic market for these industries, giving them an advantage in the global market, Thornton-Trump notes.
Relations between China and the Philippines have deteriorated over recent months. Beijing condemned Filipino President Ferdinand Marcos Jr.s congratulations to Taiwanese President-elect Lai following the latters recent election. China regards Taiwan as a renegade province.
The Philippines has recently reaffirmed its strong alliance with the United States, announcing plans for more robust military activities with the US and its allies, much to the chagrin of China. In addition, the Philippines and China are in dispute over territorial claims involving islands and waters in the South China Sea.
The US, Japan, and the Philippines recently entered a
cyber threat-sharing arrangement
in the wake of rising attacks by China, North Korea, and Russia, a development likely to help the Philippines stay on top of the growing tide of cyberthreats.
Understanding the pattern of upsurge in malign cyber activity is the first step towards combatting it, experts say. [With] a better understanding of the countrys internal forces, and how these relate to its cyber strategy, we can plan better defenses against PRC cyber espionage, Cyjaxs Thornton-Trump says.
Resecurity offered recommendations to safeguard both the populace and Philippine business from cyberattacks:
Accelerate digital identity protection of Philippine citizens — as hack and leak activity is putting their personal data at risk of being exposed.
Tighten Web application security by implementing WAFs (web application firewalls) and ongoing vulnerability assessment and pen-testing automation procedures to detect and contain vulnerabilities before bad actors exploit them.
Create fact-checking services online to combat disinformation and influence campaigns. Citizens should be offered a process for reporting suspicious online activity.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Philippines Pummeled by Assortment of Cyberattacks & Misinformation Tied to China