MANILA, Philippines – Chinese state-sponsored hackers are said to be behind the infiltration of the computer systems of the executive branch of the Philippine government. stealing sensitive data in the yearslong campaign, according to a Bloomberg News report citing three people with knowledge of the matter.
The report said cybersecurity experts noted the infiltration in 2023 and again in August 2024. Citing email correspondence seen by Bloomberg News, the president’s office requested details of the hack from one of the experts in May 2024.
This particular breach has not been previously reported.
Jeffrey Ian Dy, undersecretary for cybersecurity at the Department of Information and Communications Technology (DICT), declined to comment on whether the president’s office was breached or that data was taken. He said, however, that “What we can confirm right now is that it is persistent, and it is consistent with advanced persistent threat groups.”
Advanced Persistent Threat groups, or APTs, is a term used to describe state-sponsored hacking groups.
Dy added that Philippine allies — Australia, Japan, the United States, and the United Kingdom — offered assistance regarding technical support and technology, and cybersecurity firms were also tapped to help.
Two of the unnamed people cited in Bloomberg’s report said the attackers used tactics often associated with a group know as APT 41.
They added the data stolen in the infiltration included military documents, including some related to the Philippines’ territorial dispute in the South China Sea.
The attack on the president’s office was said to be part of a broader campaign to compromise multiple Philippine institutions or groups, and included hospital networks. The attacks and data theft were said to have happened across early 2023 into June 2024.
Aside from the president’s office, the Philippines’ cybersecurity agency and the Federal Bureau of Investgiation (FBI) were also informed of the hacking campaign. The FBI, however, declined to comment.
A spokesperson for China’s Foreign Ministry meanwhile said it was not aware of the situation, adding China has “consistently opposed all forms of hacking and cyberattacks” as a matter of principle. “At the same time, we also oppose groundless speculation for political purposes.” – Rappler.com