Hunt.io reports theft of nearly 69 GB of backups linked to Philippine overseas employment systems
Hunt.io did not attribute the activity to a particular hacking group or country. Although some source files contained Chinese-language comments, the researchers said these were insufficient to establish the operator’s location or affiliation. The firm said it notified the relevant national computer emergency response team before publication. Its report did not disclose personal records or credentials from the affected systems.
-
Photo courtesy of Pixabay
Hunt.io said it discovered evidence of the transfer in an attacker’s working directory that had been left publicly accessible on a server hosted in Singapore. The exposed directory contained transfer logs, hacking tools, source code and other files.
According to the report, the operator’s logs recorded the completed transfer of 27 Microsoft SQL Server backup files totaling 68.837 GB in 23 minutes and 46 seconds on September 6, 2026.
The filenames included references to the Philippine Overseas Employment Administration (POEA), overseas Filipino workers, accreditation, repatriation, employment contracts and help desk services.
Hunt.io said the filenames were consistent with systems supporting the country’s overseas employment and migrant worker administration. However, the researchers did not examine the backups and could not establish their contents or the number of people whose information might have been affected.
The investigation also identified network addresses associated with Department of Migrant Workers portals that downloaded files from the exposed server. Researchers linked the addresses to the agency through domain records and digital certificates, including a wildcard certificate for its government domain issued to the POEA.
Hunt.io cautioned that the downloads established only that files had been retrieved. They did not prove that the downloaded tools were executed.
Among the recovered files was a renamed version of GodPotato, a publicly available Windows privilege escalation tool, along with a PowerShell loader and an Impacket environment, a collection of tools used to interact with Windows networks.
The report said the database transfer finished approximately 20 hours before the first recorded download of the GodPotato payload. The recovered evidence therefore did not establish that the tool had been used to steal the backups.
Researchers could not determine how the operator initially gained access, where the copied data was sent or whether the recovered payloads ran on any system.
Hunt.io did not attribute the activity to a particular hacking group or country. Although some source files contained Chinese-language comments, the researchers said these were insufficient to establish the operator’s location or affiliation.
The firm said it notified the relevant national computer emergency response team before publication. Its report did not disclose personal records or credentials from the affected systems.
Source: Hunt.io’s October 28 report on database backups linked to Philippine overseas employment systems.
Key points
- Hunt.io did not attribute the activity to a particular hacking group or country. Although some source files contained Chinese-language comments, the researchers said these were insufficient to establish the operator’s location or affiliation. The firm said it notified the relevant national computer emergency response team before publication. Its report did not disclose personal records or credentials from the affected systems.