Philippines Threat Landscape Report’s CISO Brief

Key Insights from the Philippines’ Cyber Threat Landscape for CISOs

• Dark Web Activity Driven by Monetization: Selling (over 55%) and sharing (over 40%) dominate activity, reflecting a mature black-market ecosystem for stolen data and access.
• Data Leaks and Database Theft Lead Threat Types: Data/database leaks account for 80% of dark web threats, underscoring exposure of sensitive information across public and private sectors.
• Access Listings Increase Intrusion Risk: Around 14% of threats involve direct access to networks, systems, or accounts — a major enabler for ransomware operators.
• Ransomware Fragmentation Raises Complexity: Medusa, Qilin, and LockBit are active, but nearly 68% of attacks come from smaller or emerging groups, complicating detection and attribution.
• Phishing Dominated by BET365 Lures: Nearly half of all phishing attacks impersonate BET365, followed by fake online shops, webmail logins, and cryptocurrency tools.
• HTTPS Phishing Widely Used: About 58% of phishing pages use HTTPS, making fraudulent sites appear legitimate and bypassing simple trust indicators.

Why This Report Matters for CISOs

The Philippines’ cyber threat landscape is shaped by financially motivated actors, expanding ransomware ecosystems, and aggressive phishing campaigns targeting e-commerce and online services. CISOs must adopt intelligence-driven strategies that combine strong access controls, continuous monitoring, and enhanced user awareness.

SOCRadar’s report equips CISOs with:

• Early warnings on ransomware, phishing, and dark web leaks.
• Guidance on data protection, MFA, and access governance.
• Actionable intelligence to improve SOC readiness and reduce organizational risk.