The philippines under attack: Multiple government agencies hacked together
On the night of 5 to 6 November 2026, the Philippines discovered that their systems of government were being attacked simultaneously at multiple agencies.
It was not a. There were two.
They were all at the same time.
What happened
The agencies attacked
FACT (according to NewsBites PH):
On 5-6 November, attacks were confirmed against:
Agencies of technology and information:
- DICT Alagad (Department of Information and Technology, a specialized branch)
- DICT (Department of Information and Technology, main)
Justice agencies and government:
- Presidential Commission on Good Government (PCGG, anti-corruption commission)
- Department of Labor and Employment Public Employment Service Office
Education:
- Eastern Visayas State University
National security:
- Philippine Air Force (Air Force)
- Philippine National Police clearance system
Executive:
- Vice President’s scheduling system
The scope
SPECULATION CONTROLLED: The fact that multiple independent agencies were attacked simultaneously suggests:
- The same group of attackers
- Access pre-positioned in the weeks/months before
- Timing coordinated
- Deep knowledge of government infrastructure
The impact
ANALYSIS:
- DICT: Access to infrastructure tech national
- PCGG: Access to research data anti-corruption
- Military/Police: Access to systems of national security
- VP scheduling: Information on the movement of the executive
- Universities: Access to student data
All of these agencies were attacked while the government was trying to respond.
Why it was possible to
Vulnerability 1: Lack of defense-in-depth
SPECULATION CONTROLLED: For multiple independent agencies were committed simultaneously:
- Probably share infrastructure providers common
- Or share vulnerabilities similar
- Or access was through a central point (ministry of IT)
Vulnerability 2: Lack of correlation between agencies
Even if each agency has its own security team:
- DICT team didn’t know that PCGG was being attacked
- Military didn’t know the Police was being attacked
- VP staff didn’t know universities were being attacked
Each agency saw local alerts, but no one saw the national pattern.
Vulnerability 3: an emergency Communications are not coordinated
FACT: The detection knew days later (on November 6), when the National Privacy Commission began to verify the reports.
This means:
- There was No detection centralized
- There was No warning attack ‘national progress’
- Each agency has discovered on his own, in his own timing
The pattern of attack
Phase 1: Recognition (weeks/months)
The attackers were identified:
- What agencies are critical
- How to connect to each other
- Where is stored the critical data
- How to avoid detection
Phase 2: initial Access
Probably through:
- Vulnerability in the shared system (DICT, a provider of IT)
- Phishing government employees
- Supply chain attack pathway provider of software/hardware
- Credentials compromised
Phase 3: lateral Movement
From the initial point of compromise, the attackers have moved to:
- Other agencies connected
- Backup systems
- Directories (central Active Directory from the government)
- Systems of critical data
Phase 4: Data exfiltration
Once they had access, they extracted:
- Data of investigations, anti-corruption
- National security information
- Personnel data of government
- Sensitive information of citizens
How to 24Cevent would have helped
If the government of the Philippines has a system of detection of anomalies at the national level, correlating all the agencies:
Detection of the initial access
When the attacker enters (Phase 2):
- Agency 1 (DICT): ‘Access from unknown location’
- Local detection: Generated alerts, you probably ignored
- Correlation national: NOTHING
With 24Cevent at the national level:
- Correlation: ‘Access failed, to DICT from location X’
- Context: ‘DICT is a gateway to all the agencies,’
- Escalation: ‘INITIAL ACCESS DETECTED CRITICAL COMPONENT’
- Answer: ‘Isolation immediate + audit of all the agencies connected’
The attacker is expelled before able to move laterally.
Detection of lateral movement
When the attacker moves between agencies:
- Agency 1 to 2: ‘Connection unusual among systems’
- Agency 2: ‘Access from a user who normally does not agree’
- Agency 3: ‘Query anomalous to database’
Each agency sees ‘noise local’. No one sees the pattern.
With 24Cevent at the national level:
- Correlation: ‘PCGG + Military + Police + VP showing the same pattern of access anomalous simultaneously’
- Analysis: ‘lateral Movement coordinated detected’
- Context: ‘a common Origin point of entry in DICT 3 hours ago’
- Escalation: ‘CRITICAL INCIDENT NATIONAL: lateral Movement post-commitment’
- Auto answer: ‘Lock all connections anomalous + isolation DICT + notice to NCIP’
The attacker is content while it is in motion, before the exfiltration of data is massive.
Detection of exfiltration
When the attacker attempts to exfiltration of data:
- PCGG: ‘massive release of research data’
- Military: ‘bulk Access to systems of intelligence’
- Police: ‘Query massive database of clearances’
No correlation: ‘Probably is backup regular’ or ‘is probably a legitimate user’
With 24Cevent:
- Correlation: ‘5 agencies with massive release of data simultaneously to location X’
- Analysis: ‘Pattern of exfiltration of critical data’
- Context: ‘From the compromised machine for 8 hours’
- Escalation: ‘CRITICAL INCIDENT: Exfiltration massive national data in progress’
- Answer: ‘communication Block output + insulation of the attacker + notice to NCIP/PNP/AFP’
Instead of allowing exfiltration complete, it detects and blocks in minutes.
Result
Without 24Cevent:
- Access in weeks without being detected
- Lateral movement in weeks without being detected
- Exfiltration in hours or days without being detected
- Discovery: Accidental, after the damage
With 24Cevent national:
- Access detected in hours
- Lateral movement detected in minutes
- Exfiltration blocked in minutes
- Response: Coordinated at the federal level
The lesson for governments
This incident proves that:
- The coordinated attacks at the national level are real
- Each agency is seeing only his ‘noise local’ is not enough
- Without centralized correlation, the pattern is invisible
- The answer should be national, not by agency
The philippines needs:
- A center of operations of national cybersecurity
- Correlation of indicators of all the agencies
- Coordinated response to executive level
- Automation of detection and blocking
SOURCES CHECKED: