An attacker copied nearly 69GB of Philippine Overseas Employment Administration data out of the agency’s control, Hunt.io researchers said in an analysis reported by Dark Reading. The transfer involved 27 backup databases associated with overseas employment, putting worker, contract and financial information at risk of misuse.
Hunt.io’s Oct. 28 analysis found logs showing that the backups were copied over 24 minutes to a staging server in Singapore—an intermediate system used to hold data. The databases covered overseas-employment case management, including accreditation, contracts, cashier and LandBank records. Hunt.io did not open the backups, so its assessment rests on the exposed logs and other artifacts.
The findings matter to overseas workers whose information may be held in those systems and to officials responsible for protecting it. Hunt.io research head Esteban Borges told Dark Reading that migrant-worker personal information, combined with contract and payment data, could support fraud and identity theft. He also said the detailed picture of a diaspora population could interest a state actor.
Exposed server revealed the transfer
Researchers discovered an openly accessible directory on a server in the Singaporean address space of Helsinki-based hosting company UpCloud Ltd. It contained attack tools and log files, giving Hunt.io a view of the operation.
The tools included a rebranded version of GodPotato, used for privilege escalation—gaining greater permissions on a system—and a PowerShell stager designed to unpack tools in memory. Researchers also found a full Python environment for Impacket, a library for interacting with network services. Hunt.io described the operation as using GodPotato, SeImpersonate capabilities and Impacket to gain access and move data.
The transfer logs led Hunt.io to classify the incident as a confirmed compromise, although the lack of runtime telemetry left the initial entry method and execution of the discovered payload unresolved. The Oct. 28 analysis date marks disclosure of the findings, rather than an established date for the intrusion.
Borges characterized the operator as technically capable but careless about concealing the infrastructure. The payload engineering was competent, he said, while leaving the staging server and its logs openly accessible exposed the operation.
The trail ended at that server. It was accessed later by an unidentified party, and Borges could not establish where the backups ultimately went. Hunt.io had not seen them advertised for sale or published in a leak when Dark Reading reported the findings.
No attribution, but concrete exposure concerns
Hunt.io did not attribute the attack. Chinese-language fragments appeared in code from a third-party software library, giving the researchers no basis to identify a Chinese operator. Both criminals and state-backed actors could find value in the information, Borges said.
The discovery follows Hunt.io’s August finding of another attacker’s workspace containing tools and 1.2GB of data stolen from a Philippine nuclear regulatory agency and a maritime shipbuilding contractor.
Hunt.io notified CERT Philippines, the national computer emergency response team, and the Department of Migrant Workers. The company declined to provide further details about the national response.
For government administrators, Borges recommended scanning their networks and reducing exposed services and excessive account privileges. Hunt.io found that the migrant-worker portal exposed SMB, a Windows file-sharing service, on port 445, and WinRM, Windows remote management, on ports 5985 and 47001. Administrators should review those exposures and limit unnecessary permissions, which Borges said can allow attackers using impersonation capabilities such as SeImpersonate to reach more network assets.
