Swedish digital forensics non-profit Qurium traced the recent cyberattacks on alternative media outlets AlterMidya and Bulatlat and rights group Karapatan to a military intelligence unit.
A digital certificate showed the machine that conducted a “vulnerability scan” on Bulatlat was linked to a Philippine military email address and the Office of the Assistant Chief of Staff for Intelligence.
It added this same machine was also using an IP address registered as the Department of Science and Technology.
Qurium added it found within the network of the DOST machine another setup with an identical firewall configuration, “strongly suggesting the machine was set up and operated by the same organization.”
DOST has denied involvement in the cyberattacks, saying tracing the attacks to an IP address linked to them does not mean they had a hand in these as they allow some of their IP addresses to be used by other government agencies.