Exposed Server Found Hosting Stolen Philippine Government Database Backups
Hunt.io discovered an open directory on an UpCloud server containing 68.837 GiB of stolen SQL Server backups and custom privilege-escalation tools.
Hunt.io found an open web directory on Linux server 213.163.205[.]35 at UpCloud Ltd (AS202053) in Singapore, where an operator stored 68.837 GiB of database backups copied from a Philippine government agency. The directory exposed a transfer log, a PowerShell stager, a full Impacket environment, and a rebranded build of the GodPotato privilege-escalation tool named Wrqsnx.dll and Wrqsnx_portal.dll. Hunt.io notified the national CERT prior to publishing.
The transfer log shows 27 SQL Server backups copied on 6 September 2026 in 23 minutes and 46 seconds. Filenames match case-management systems from a Philippine overseas-employment and migrant-worker administration, including POEA and OFW variants. While the log displays a rate of 20.238 MiB/s, the volume and duration average 49.4 MiB/s, which Hunt.io attributes to Rclone using a rolling average at completion. A second log recorded a failed attempt 14 hours later against a non-existent source path. Python's built-in HTTP server ran on port 80 with directory listing enabled, while port 8888 hosted a small Python upload receiver with an empty log.
GodPotato is a public .NET tool that uses DCOM and RPC to escalate a service account to SYSTEM without a Windows vulnerability, detected by Microsoft as Trojan:MSIL/GodPotato.FF!MTB. The rebranded build copies the combase.dll image into memory, searches for a byte pattern, and replaces the transport dispatch table entry. It creates the named pipe \\.\pipe\Wrqsnx\pipe\epmapper with full control for Everyone, duplicates a SYSTEM token, and runs a base64 command from C:\Users\Public\ptcmd.txt. Cleanup restores the function pointer but leaves the memory page writable.
An eight-line PowerShell stager decodes in-memory base64 fragments named p_*.b64 from C:\Users\Public and loads the assembly without touching disk. Two payload builds compiled by Mono's mcs and Microsoft's Roslyn were recovered, though the source tree fails to build due to a missing helper class named Sunday. The Impacket toolkit contained 69 Python scripts without hardcoded addresses, including two checking LDAP or MSSQL relay and one filtering for Windows Server 2025 domain controllers. The data transfer finished over 20 hours before the first payload retrieval, and the capture contains no initial access vector, command-and-control channel, or personal records.