Philippines Pummeled by Cyberattacks & Misinformation Tied to China

A recent massive spike in cyber misinformation and hacking campaigns against the Philippines coincides with rising tensions between the country and its superpower neighbor China.

The cyberattacks consist of a combination of hack and leak (55%), distributed denial-of-service (10%), and misinformation and influence campaigns (35%), according to researchers at Resecurity who have been following the campaigns. The main targets are government (80%) and educational institutions (20%) in the Philippines, and these attacks — on police agencies, government ministries, and universities — and associated data leaks are sowing discontent in the country, according to the researchers.

This represents a four-fold (325%) increase in what the researchers identify as malicious cyber-espionage activity targeting the Philippines in the first quarter of 2024 compared to the same period last year. “The goal of this activity is to discredit the government and create chaos via cyberspace, as the Philippine population also relies on digital media channels and is active on social media networks,” says Shawn Loveland, COO of Resecurity.

Resecurity has worked with authorities in the Philippines to trace back the source of attacks to online infrastructures in China and Vietnam. These “false flag” and “other territories” could be allies of China in such campaigns or provide them infrastructure for it, according to Resecurity.

Fake News

The goal of the cyberattacks correlates with disinformation campaigns spinning Chinese narratives on topics such as regional disputes about territories in the South China Sea.

In a blog post this month, Resecurity detailed the myriad of different groups associated with this collective activity. In one notable attack, a threat actor going by the alias “KryptonZambie” claimed to have obtained from unnamed sources over 152 gigabytes of stolen data containing Philippine citizen identity cards. Resecurity investigated this claim, which related to a post on Breach Forums, a Dark Web site, but found it unsubstantiated. The threat actor did not respond to any messages Resecurity investigators sent to a Telegram account used to publicize the supposed breach.

Other elements of the campaign involved posting an “audio deepfake” of Philippine President Ferdinand Marcos Jr. supposedly ordering military action against China. No such directive exists, according to authorities in the Philippines.

It’s not all fakery, however. Several of the groups covered by Resecurity’s report — including  Philippines Exodus Security and DeathNote Hackers — ran attacks that led to a confirmed data breach.

Not Real Hacktivists

While some of this activity might resemble that of hactivists, Resecurity believes nation state-backed hackers from China or possibly North Korea (another regional adversary to the Philippines) are really to blame.

Resecurity has reported over 12 government organizations in the Philippines being targeted in the same timeframe — hallmarks of a well-organised co-ordinated attack by nation-state actors rather than independent hacktivists.

“Leveraging hacktivist-related monikers allows threat actors to avoid attribution while creating the perception of homegrown social conflict online,” according to Resecurity.

Last year a Chinese state-linked advanced persistent threat (APT) group known as Mustang Panda hacked a Philippine government target via a simple side-loading technique. “This group has a strong focus on Philippines and [is] still active,” according to Resecurity. Hacks by the group on Philippine government entities have been actively promoted via social media.

In April 2023, more than 800 gigabytes of both applicant and employee records from multiple state agencies — including the Philippine National Police (PNP), National Bureau of Investigation (NBI), Bureau of Internal Revenue (BIR), and Special Action Force (SAF) — were compromised.

This was followed in September by a breach and ransomware attack on the Philippine Health Insurance Corporation (PhilHealth) that led to the exposure of hospital bills, internal memos, and identification documents. There remains an ongoing investigation into the full extent of the leak, according to cyber threat detection firm Gatewatcher.

Why Spy?

China (and to a lesser extent North Korea) is the prime suspect in much of this malfeasance, according to both Resecurity and other threat intel experts.

“China is a far more complex and nuanced territory than generally portrayed. Its internal pressures are likely to lead to increased cyber-espionage activity, rather than slowing it down,”  says Ian Thornton-Trump, CISO at threat intel firm Cyjax.

“The PRC’s approach to cyberspace has always been to use it to advance its business interests, extracting technologies from Western companies and creating a protected domestic market for these industries, giving them an advantage in the global market,” Thornton-Trump notes.

Relations between China and the Philippines have deteriorated over recent months. Beijing condemned Filipino President Ferdinand Marcos Jr.’s congratulations to Taiwanese President-elect Lai following the latter’s recent election. China regards Taiwan as a renegade province.

The Philippines has recently reaffirmed its strong alliance with the United States, announcing plans for “more robust” military activities with the US and its allies, much to the chagrin of China. In addition, the Philippines and China are in dispute over territorial claims involving islands and waters in the South China Sea.

Incident Response

The US, Japan, and the Philippines recently entered a cyber threat-sharing arrangement in the wake of rising attacks by China, North Korea, and Russia, a development likely to help the Philippines stay on top of the growing tide of cyberthreats.

Understanding the pattern of upsurge in malign cyber activity is the first step towards combatting it, experts say. “[With] a better understanding of the country’s internal forces, and how these relate to its cyber strategy, we can plan better defenses against PRC cyber espionage,” Cyjax’s Thornton-Trump says.

Resecurity offered recommendations to safeguard both the populace and Philippine business from cyberattacks: