68 GB Stolen From a Philippine Government Agency's Overseas-Employment Databases, Exposed by the Operator's Own Open Directory

An unidentified operator exfiltrated 68.837 GiB of database backups from a Philippine government agency managing overseas employment and migrant workers on 6 September 2026. The theft involved 27 SQL Server backups containing case-management systems including POEA and OFW variants. The operator inadvertently exposed their staging infrastructure via an open HTTP directory on a UpCloud VPS in Singapore, revealing a rebranded GodPotato privilege escalation tool (renamed Wrqsnx), PowerShell stagers, Impacket toolkit, and transfer logs. The payload leverages DCOM and RPC mechanisms to achieve SYSTEM-level access without exploiting vulnerabilities. Certificate analysis linked the compromised infrastructure to the Philippine Overseas Employment Administration portal farm. Initial access vectors and command-and-control channels remain unidentified, though tooling was delivered to agency portal hosts.

• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress ExploitationCampaign2026-09-22
• How AI Agents Turned One Exposed Endpoint into a Server TakeoverCampaign2026-10-15
• Phishing Email Delivers ScreenConnect MalwareMalware2026-08-04
• Citrix NetScaler ADC and Gateway · CitrixBleed 2 (CVE-2025-5777) 7 Steps to Dragonforce RansomwareExploitedVulnerability2026-07-09
• RedHook Returns with a Dangerous UpgradeMalware2026-07-09