Persistent Cyberattacks Target PH Government – DICT

Summary

The Department of Information and Communications Technology (DICT) confirmed persistent cyberattacks targeting Philippine government agencies, particularly those under the executive branch.

Key points:
• Attacks ongoing since 2023
• Target multiple government offices including the Office of the President
• Conducted by highly organized and sophisticated threat actors
• Some attacks were blocked, while others successfully penetrated systems

These are not isolated incidents but continuous, evolving intrusion attempts.

Research Source

According to ABS-CBN News:

• Attacks are linked to tactics used by China-associated threat groups
• DICT observed patterns consistent with known APT activity
• Similar campaigns have been seen globally (US, UK, and regional targets)

Mentioned threat groups:
• APT41
• APT21

DICT stopped short of officially attributing the attacks to a nation-state but confirmed TTP alignment with Chinese-linked actors.

Technical Details
Attack Characteristics

• Persistent intrusion attempts across multiple entry points
• Adaptive behavior when blocked (switching targets/databases)
• Long-term reconnaissance and exploitation strategy

Tactics, Techniques, and Procedures (TTPs)

• Advanced Persistent Threat (APT)-style operations
• Multi-vector attacks targeting government systems
• Continuous probing of vulnerabilities
• Potential data exfiltration (unconfirmed for military data)

Targeted Entities

• Office of the President
• Philippine Coast Guard
• Department of Environment and Natural Resources (DENR)
• Department of Agriculture

Threat Nature

• Not typical cybercriminal activity
• Likely state-aligned or highly resourced actors
• Focus on intelligence gathering and system access

Observed Attack Activity
Initial Access

• Exploitation of vulnerabilities in government systems
• Continuous scanning and probing of online assets

Execution

• Repeated intrusion attempts using varying techniques
• Sophisticated attack chains indicating advanced tooling

Persistence

• Attackers reattempt access after being blocked
• Shift targets across different systems/databases

Lateral Movement (Potential)

• Attempts to expand access across agencies

Command & Control

• Not explicitly detailed, but consistent with APT operations

Threat Actor
Attribution

• Suspected China-linked threat actors
• No official state attribution confirmed

Indicators suggest:

• Advanced Persistent Threat (APT) operations
• High level of coordination and funding
• Long-term strategic objectives

Likely Motivation

• Cyber espionage
• Intelligence gathering (possibly geopolitical)
• Strategic surveillance of government infrastructure

Impact
National-Level Risks

• Potential exposure of sensitive government data
• Threat to national security and defense systems
• Increased vulnerability to cyber warfare

Organizational Risks

• Compromise of government systems
• Data breaches across agencies
• Disruption of public services

Strategic Impact

• Highlights shift toward digital warfare
• Elevates cybersecurity as a national security priority

Mitigation

Recommended actions for government and organizations:

• Strengthen vulnerability management and patching
• Implement Zero Trust architecture
• Enhance network segmentation across agencies
• Deploy advanced threat detection (EDR/XDR)
• Continuous monitoring and threat hunting
• Conduct regular security audits and red teaming
• Improve incident response readiness
• Leverage threat intelligence on APT groups

Key Takeaway

These are not one-time hacks
they are sustained, strategic cyber operations.

The shift from random attacks to persistent, state-level campaigns means:

• Defense must be continuous
• Detection must be proactive
• Cybersecurity is now part of national defense

References

• https://www.abs-cbn.com/news/nation/2025/1/7/dict-confirms-persistent-cyberattacks-targeting-offices-under-executive-branch-1341

• This topic was modified 6 days, 14 hours ago by Rameses Quiambao.