CREDENTIAL EXPOSURE — 2025 TO 2026
Most ransomware victims were already for sale
54%
of ransomware victims had corporate credentials appear in stealer-log marketplaces before the attack — Verizon 2025 DBIR. Flashpoint recorded 1.8 billion credentials harvested in H1 2025 alone.
Infostealers harvest saved browser credentials and sell them on dark web markets. The final intrusion looks like a legitimate login — tooling sees nothing. The lag between theft and use is the detection window.
A credential in a stealer log is a named, dated, actionable signal. Forcing a reset takes five minutes. Discovering it during incident response does not.
PHILIPPINE PUBLIC SECTOR — 2023 TO 2026
The forgotten subdomain is doing more damage than the flagship system
234
data breaches at high-level government agencies in 2025, disclosed by the National Intelligence Coordinating Agency at a Senate hearing. The agencies were not named.
Philippine government breaches consistently originate from adjacent or forgotten systems — not the flagship platform. The PSA CBMS breach, the 2TB DOST incident, and 19 defaced sites in a single September 2025 window all followed the same pattern.
External attack surface management finds assets nobody remembers commissioning — the only method that builds inventory from the attacker's vantage point.
FINANCIAL SERVICES — AFASA, RA 12010
The cost of a phishing domain sits on the bank's balance sheet
76%
of Philippine fraud losses in 2025 came from social engineering, account takeover, and identity theft — per BSP data. Three quarters of losses originate in infrastructure the bank does not monitor.
AFASA's grace period lapsed in June 2026. Banks that cannot demonstrate adequate controls now absorb customer losses. Most fraud infrastructure — look-alike domains, phishing pages — never touches the institution's network.
Look-alike domain monitoring creates a timestamped record of the institution acting on external intelligence — worth something in a dispute as well as a fraud queue.
REGIONAL THREAT LANDSCAPE — 2025
Philippine criminal activity is aimed at Philippine targets
80%
of observed dark web threats involved data or database leaks. 78% of dark web activity and 88% of ransomware attacks targeted Philippine organisations exclusively — SOCRadar 2025.
Public administration, education, and financial services together account for close to half of all observed threats. The ransomware picture is fragmented — no group dominates — but material moves fast through commercial marketplaces.
A feed calibrated to North American patterns misses the local forum where your sector is discussed. Coverage has to be aimed at the right place, read by someone who knows what an RSBSA portal is.
