Jan 12, 2026, 12:17 AM
The underground ecosystem is quite diverse and unique. This adversarial universe involves multiple local and foreign threat groups known for past attacks against government agencies and major enterprises during local conflicts and military engagements.
One of the most notable groups in this ecosystem is Exodus Security. The group was founded on February 4, 2009. Initially, Exodus Security had a compact structure consisting exclusively of red-team (penetration-testing) specialists. However, the group became a high-profile hacktivist collective responsible for major cyberattacks against government agencies and enterprises in the Philippines and globally. On approximately February 15, 2024, the group started recruiting new members with experience in penetration testing and web-application hacking.
This past February, the group staged multiple targeted DDoS attacks. It leaked stolen data from targets in the Philippines and other countries, including the UK, France, Indonesia, Israel, and India. The group also announced several partnerships with other actors, including:
- Cyber Operation Alliance (COA)
- Robin Cyber Hood (RCH)
- Arab Anonymous
- Sylhet Gang-SG
Another notable local group is DeathNote Hackers (Philippines). The group was likely responsible for a data leak from the Bureau of Customs under the flag of the #OPBOC campaign, which trended on social media and in notable hacktivist communities.
- Philippine Hacking University
- Excommunicado
- CyberMafia Philippines
- Philippine Cyber Alliance
- LizardSquad Philippines
- Bisaya Cyber Army
Source: https://www.resecurity.com/blog/article/...with-china
One of the most notable groups in this ecosystem is Exodus Security. The group was founded on February 4, 2009. Initially, Exodus Security had a compact structure consisting exclusively of red-team (penetration-testing) specialists. However, the group became a high-profile hacktivist collective responsible for major cyberattacks against government agencies and enterprises in the Philippines and globally. On approximately February 15, 2024, the group started recruiting new members with experience in penetration testing and web-application hacking.
This past February, the group staged multiple targeted DDoS attacks. It leaked stolen data from targets in the Philippines and other countries, including the UK, France, Indonesia, Israel, and India. The group also announced several partnerships with other actors, including:
- Cyber Operation Alliance (COA)
- Robin Cyber Hood (RCH)
- Arab Anonymous
- Sylhet Gang-SG
Another notable local group is DeathNote Hackers (Philippines). The group was likely responsible for a data leak from the Bureau of Customs under the flag of the #OPBOC campaign, which trended on social media and in notable hacktivist communities.
- Philippine Hacking University
- Excommunicado
- CyberMafia Philippines
- Philippine Cyber Alliance
- LizardSquad Philippines
- Bisaya Cyber Army
Source: https://www.resecurity.com/blog/article/...with-china