{
 "response": [
  {
   "Event": {
    "uuid": "f7d316db-381f-51e6-a4ea-729844292af2",
    "info": "Qilin ransomware compromises the Philippine Ports Authority",
    "date": "2026-09-05",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"ransomware\""
     },
     {
      "name": "misp-galaxy:country=\"philippines\""
     },
     {
      "name": "misp-galaxy:sector=\"Transportation and Maritime\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/qilin-ransomware-compromises-the-philippine-ports-authority/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.hookphish.com/blog/ransomware-group-qilin-hits-philippine-ports-authority/",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://ctiwatch.com/victims/0e550d65-88dc-4a3b-9d25-8d5d367e65e4-philippine-ports-authority",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.moxfive.com/blog/qilin-ransomware-2026-ttps-victims-and-defense-guide",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "The Philippine Ports Authority was compromised on 5 September 2026 in an intrusion attributed to the Qilin ransomware operation and subsequently added to the group's data-leak site as part of a double-extortion campaign. The victim sits squarely in the transportation and maritime logistics sector at a time of heightened South China Sea tension, giving the incident strategic as well as commercial significance. Qilin remained the most prolific ransomware brand globally in 2026, with more than 500 victims claimed during the year.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "a6563912-5ce5-5cf1-9ab1-d7a45734bf80",
    "info": "Philippine SMS Provider Breach Allegedly Exposes 160 Million Messages",
    "date": "2026-08-14",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"data_breach\""
     },
     {
      "name": "misp-galaxy:country=\"philippines\""
     },
     {
      "name": "misp-galaxy:sector=\"telecommunications\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/philippine-sms-provider-breach-allegedly-exposes-160-million-messages/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://www.cyfirma.com/news/weekly-intelligence-report-14-aug-2026/",
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "A Philippine SMS/telecommunications provider was reported compromised in August 2026, with threat actors alleging exposure of around 160 million SMS messages along with associated user data. The incident comes as Viettel Cyber Security reported more than 19.2 million Philippine account credentials compromised in the first half of 2026 amid surging phishing and breach activity.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "1d3efc68-6633-5157-bde1-788fe362998d",
    "info": "Massive DDoS Attack on Philippine Election Infrastructure",
    "date": "2026-05-05",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"ddos\""
     },
     {
      "name": "misp-galaxy:country=\"philippines\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Election Infrastructure\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/massive-ddos-attack-on-philippine-election-infrastructure/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "DICT Philippines Advisory",
       "url": "https://dict.gov.ph/"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "Rappler Coverage",
       "url": "https://www.rappler.com/technology/"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Philippine COMELEC (Commission on Elections) voter verification systems experienced sustained DDoS attacks peaking at 3.2 Tbps during the May 2026 midterm election preparation period. Attacks originated from a botnet comprising compromised IoT devices across Southeast Asia. Philippine DICT (Department of Information and Communications Technology) and Cloudflare mitigated the attacks within 6 hours, but voter registration portal experienced intermittent outages over 3 days.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "2f3f0da8-0a2d-56d3-817a-eba0777e6843",
    "info": "Earth Alux Espionage Campaign Targets ASEAN Defense Ministries",
    "date": "2025-10-15",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:threat-actor=\"Earth Alux\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:country=\"philippines\""
     },
     {
      "name": "misp-galaxy:country=\"vietnam\""
     },
     {
      "name": "misp-galaxy:country=\"malaysia\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense Industrial Base\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/earth-alux-espionage-campaign-targets-asean-defense-ministries/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "Trend Micro Research",
       "url": "https://www.trendmicro.com/en_us/research.html"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Trend Micro researchers disclosed an ongoing espionage campaign by Earth Alux (China-linked) targeting defense ministries and military contractors across Thailand, Philippines, Vietnam, and Malaysia. The group deployed VARGEIT and COBEACON implants via trojanized military procurement documents. The campaign has been active since at least Q4 2025, with lateral movement into classified networks confirmed at two ASEAN defense organizations.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  },
  {
   "Event": {
    "uuid": "91156f08-77d1-56e9-a07f-3cdbff47a209",
    "info": "Salt Typhoon Telecom Espionage Campaign — Ongoing",
    "date": "2024-09-15",
    "threat_level_id": "1",
    "analysis": "2",
    "distribution": "3",
    "published": false,
    "Orgc": {
     "name": "SecurityStudies.info"
    },
    "Tag": [
     {
      "name": "tlp:clear"
     },
     {
      "name": "securitystudies:status=\"curated\""
     },
     {
      "name": "securitystudies:type=\"espionage\""
     },
     {
      "name": "misp-galaxy:threat-actor=\"GhostEmperor\""
     },
     {
      "name": "misp-galaxy:country=\"united states\""
     },
     {
      "name": "misp-galaxy:country=\"philippines\""
     },
     {
      "name": "misp-galaxy:country=\"thailand\""
     },
     {
      "name": "misp-galaxy:country=\"australia\""
     },
     {
      "name": "misp-galaxy:country=\"indonesia\""
     },
     {
      "name": "misp-galaxy:country=\"taiwan\""
     },
     {
      "name": "misp-galaxy:country=\"japan\""
     },
     {
      "name": "misp-galaxy:sector=\"Telecommunications\""
     },
     {
      "name": "misp-galaxy:sector=\"Government\""
     },
     {
      "name": "misp-galaxy:sector=\"Defense\""
     }
    ],
    "Attribute": [
     {
      "type": "link",
      "category": "External analysis",
      "value": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/",
      "comment": "SecurityStudies.info entry",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "CISA Advisory AA24-340A",
       "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "link",
      "category": "External analysis",
      "value": {
       "title": "Microsoft Threat Intelligence",
       "url": "https://www.microsoft.com/en-us/security/blog/"
      },
      "comment": "source",
      "to_ids": false
     },
     {
      "type": "text",
      "category": "Other",
      "value": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.",
      "comment": "summary",
      "to_ids": false
     }
    ]
   }
  }
 ]
}