An unidentified operator exfiltrated 68.837 GiB of database backups from a Philippine government agency managing overseas employment and migrant workers on 6 September 2026. The theft involved 27 SQL Server backups containing case-management systems including POEA and OFW variants. The operator inadvertently exposed their staging infrastructure via an open HTTP directory on a UpCloud VPS in Singapore, revealing a rebranded GodPotato privilege escalation tool (renamed Wrqsnx), PowerShell stagers, Impacket toolkit, and transfer logs. The payload leverages DCOM and RPC mechanisms to achieve SYSTEM-level access without exploiting vulnerabilities. Certificate analysis linked the compromised infrastructure to the Philippine Overseas Employment Administration portal farm. Initial access vectors and command-and-control channels remain unidentified, though tooling was delivered to agency portal hosts.
