Alternative news websites hit by alleged state-backed cyberattacks: digital forensics

Jauhn Etienne Villaruel, ABS-CBN News

Posted at Jun 24 2021 11:28 AM | Updated as of Jun 25 2021 02:57 PM

Alternative news websites hit by alleged state-backed cyberattacks: digital forensics 1
Altermidya and Bulatlat condemned the cyberattacks traced by a Sweden-based digital forensics group to the Philippine Army and DOST.

MANILA (2ND UPDATE) — Two alternative news organizations cried foul Wednesday after a Sweden-based digital forensics group uncovered a barrage of potentially state-backed cyberattacks against their websites.

Qurium Media Foundation reported Tuesday that it recorded in the past months "brief but frequent denial attacks against" websites,, as well as

Notably, on June 5, Qurium said a machine from the Department of Science and Technology (DOST) launched a vulnerability scan against Bulatlat. 

The National Union of Journalists of the Philippines (NUJP) described a vulnerability scan as an "automated, high level test that creates an inventory of all known and potential weaknesses in a network," adding such test is "highly irregular" when done without permission from the system owner.

Looking closely at the IP address and firewall, Qurium extracted the email address "" The URL "" is the official website of the Philippine Army.

"Another interesting finding was to find the attacker IP in the Edits of Wikipedia for the article 'Chief of Army (Philippines)' and many others related to the Army," Qurium reported.


Video courtesy of PTV

Launching a cyber attack "is a crime," noted Malacañang spokesman Harry Roque. 

"It will be investigated, and I will reiterate that it is unfair to link government officers to these cyber attacks, pending investigation," he said in a press briefing. 

He added that he was not familiar with the Qurium group. 

"At hindi ko po alam kung talagang competent siyang magbigay ng testimonya dito sa ating bansa," said the Palace official.
(And I do not know if this group really has competence to give testimony here in our country.) 


In separate statements, Altermidya and Bulatlat condemned the cyberattacks. 

"We are not surprised by the results of the recent digital forensic… Still, we are angered that taxpayers’ money is being spent to bring down our website, and to deny our readers access to our reportage,” Bulatlat said Wednesday in a series of tweets. 

Bulatlat emphasized that the cyberattacks happened in light of the red tagging by the National Task Force to End Local Communist Armed Conflict (NTF-ELCAC) and other "state agents."

"We enjoin our colleagues in the Philippine media, and our audience to continue asserting press freedom," Bulatlat said.

Altermidya, for its part, said it "condemns these cyberattacks on our websites, as well as those against other progressive groups."


In a statement Thursday, DOST said accusations it was behind cyberattacks against the news websites were "unfounded and patently false."

"The implication of DOST’s involvement in said cyber-attacks is unfounded and patently false."

The agency said part of its mandate was to "assist other government agencies by allowing the use of some of its IP addresses in the local networks of other government agencies."

"This statement [of Qurium] was solely based on the tracked IP address and does not translate to the Department’s involvement in the matter. DOST remains committed to working towards a progressive Philippines, with science in full service of the Filipino people," it added. 


Philippine Army spokesperson Col. Ramon Zagala on Wednesday told ABS-CBN News they "respect" freedom of expression and will not tolerate such attacks. 

"The Philippine Army respects freedom of expression and per policy, will never infringe [on] that freedom. We take these accusations of cyberattack seriously and we will not condone or tolerate it if such occurred against media entities. Rest assured we are servants of the people and protector of freedom of expression," Zagala said.

Asked if the Army will investigate the matter, Zagala said "we will look into it."

Last September, Facebook removed pages, accounts, groups and Instagram profiles of two unnamed networks, with one linked to individuals associated with the Philippine military and police, due to "coordinated inauthentic behavior" or manipulation campaigns on the platform.


According to Bayan Muna Rep. Ferdinand Gaite, Quirium's report was "damning evidence" of the government's agenda to silence the press.

"This is damning evidence that the government is out to silence the press, and belies the administration's repeated claims that they are not attacking press freedom. Malinaw na malinaw ito, the cyberattacks were traced back to the government, which means it is an official policy of this administration to attack media organizations," Gaite said in a statement.

He added that the report proves the Duterte administration is "indeed operating troll farms" to attack government critics.

"Kailangan na talaga isapubliko ang mga impormasyong una nang nilantad ni Sen. Lacson patungkol sa troll farms ng gobyerno. Our taxes are funding these illegal operations, these operations that are meant to attack our country's democracy," said Gaite.

Gaite was referring to Sen. Panfilo Lacson's exposé that an "undersecretary" is assembling "2 troll farms each" in every province ahead of the 2022 national elections, possibly using public funds.

Lacson has yet to identify the official but said he would do so if his whistleblower agrees. 


Watch more on iWantTFC

— With a report from Jamaine Punzalan, ABS-CBN News