DICT: China-linked group attempted to hack DENR database

MANILA, Philippines — A group that was linked to China had allegedly attempted to hack the system of the Department of Environment and Natural Resources (DENR) in March, according to the Department of Information and Communications Technology (DICT).

This was revealed by DICT Undersecretary Jeffrey Ian Dy during last Wednesday’s hearing of the House committee on information technology, on the “massive data breach” in some government agencies.

Dy said the DICT was able to thwart the hacking attempt as part of the agency’s Project SONAR or Secure Online Network Assessment and Response System, which was launched in December 2023.

In Project SONAR, DICT looks into government agencies’ systems to determine their “vulnerabilities.”

Dy noted that in DENR, they “detected and defended” a possible “Cobalt strike (C&C) connection” by “Deep Panda APT (Advance Persistent Threat) group.”

“This is the same group that is responsible for February incidents where we did note some Chinese – potentially those coming from that country – attempted to attack our government mail systems,” he added.

The official also said they observed that attacks on the Philippines usually happened after an attack on certain infrastructure in the United States.

He cited an attempt to breach Google Workspace, which hosts the Philippine government’s email and storage for non-confidential information.

This incident took place in the aftermath of the hacking of Google Cloud Services in the US.

Another incident is the hacking of Microsoft Mail Exchange and Microsoft Azure in the US which happened before the attempt to penetrate DENR’s system.

Asked by panel member and Antipolo Rep. Romeo Acop if the hacking incidents in the Philippines are connected with the growing tension with China over the West Philippine Sea, Dy did not comment.

“May I be excused from answering that question. I don’t have the correlation as a data,” Dy maintained.

Philippines crisis

Hacking in the Philippines can now be considered a crisis, as even government agencies are being affected by it, Digital Pinoys – a group of information technology experts – claimed yesterday.

“We can already consider as a crisis the hacking, if government agencies are already affected by it,” the group said in a statement released to dzBB yesterday.

But the DICT was quick to disagree with the Digital Pinoys’ statement.

Carlos Reyes, of the DICT Cybersecurity bureau, said the agency remained on top of the situation as the agency managed to counter and stop hacking incidents.

“It does not mean that they are successful in their attacks and breaches. Those attacks, probably 10 percent success. We still do actions for it to be remediated as well,” Reyes said.

The DICT admitted that they need more manpower. At present, the agency only has 60 cybersecurity personnel.

Reyes said they need an additional 200 cybersecurity experts to ensure that the agency’s work against cyberattacks will be more efficient.

This number is a far cry from Singapore, which has 800 cybersecurity experts and Myanmar with 400 experts.

For his part, DICT Secretary Ivan John Uy said the government is presently recruiting more cybersecurity experts.

“The government needs skilled individuals who will combat cyber threats and ensure the safety of our fellow Filipinos,” Uy said.

He said that this is the primary reason why the DICT is conducting the annual Hack4Gov competition to discover new breed of cybersecurity experts.

In Hack4Gov, teams are given cyberattack scenarios. The first team to fend off the attack, wins.

The Hack4Gov competition was started in 2019 and will be held in other regions around the country. — Jose Rodel Clapano