Cyber Warfare Force, Philippine Navy

03/11/2026

READ | The Philippine Navy's Leadership Quote for the Week.

“A leader should be the strength of the team. But the team is also the strength of the leader.”

Rear Admiral Juario C Marayag PN
Commander, Sea Systems Command, PN

PN @128: Modern and Ready, Strong and Steady — Credible in Mission, Always Mission-Ready







⁩

28/10/2026

20/10/2026

20/10/2026

As part of the Philippine Navy's (PN) modernization program, the ON has launched its third Offshore Patrol Vessel (OPV) in Ulsan, South Korea on 13 October 2026. | Jonas Reyes

05/10/2026

READ | The Philippine Navy's Leadership Quote for the Week.

“A leader does not merely command men, he gives them purpose, preserves their dignity, and inspires them to stand strong together.”

Commodore Jim P Razo PN
Commander, Special Warfare Force, Philippine Navy

PN @128: Modern and Ready, Strong and Steady — Credible in Mission, Always Mission-Ready







⁩

03/10/2026

𝗔 𝗟𝗲𝗴𝗮𝗰𝘆 𝗼𝗳 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 | 𝗖𝗪𝗙, 𝗣𝗡 (𝗣) 𝗛𝗼𝗻𝗼𝗿𝘀 𝗧𝗵𝗲 𝗼𝘂𝘁𝗴𝗼𝗶𝗻𝗴 𝗠𝗖𝗣𝗢, 𝗖𝗪𝗙, 𝗣𝗡 (𝗣) 𝗗𝗣𝗖 𝗙𝗿𝗲𝗱𝗲𝗿𝗶𝗰 𝗔 𝗔𝗻𝗶𝘀𝗰𝗼 𝗣𝗡

𝟮𝟴 𝗔𝘂𝗴𝘂𝘀𝘁 𝟮𝟬𝟮𝟲 – The Cyber Warfare Force, Philippine Navy (Provisional) (CWF, PN (P)), gathered to honor and celebrate the composory retirement of its Master Chief Petty Officer, CWF, PN (P) Data Processing Chief (DPC) Frederic A Anisco PN, during a Change of Chief of Office and retirement ceremony held at the Sea Systems Command, Philippine Navy (SSC, PN) Multipurpose Hall, Naval Station Pascual Ledesma (NSPL), Fort San Felipe, Cavite City. Last 28 August 2026

The ceremony served as a heartfelt tribute to DPC Anisco PN’s 35 years of dedicated, honorable, and selfless service to the Philippine Navy, the Filipino people, and the nation. Throughout his distinguished naval career, he exemplified professionalism, discipline, leadership, and an unwavering commitment to duty, leaving a lasting mark on the personnel and organization he served.

During his officially tenure with CWF, PN (P), DPC Anisco PN provided steadfast leadership, valuable guidance, and unwavering support to the Force’s personnel. His experience, dedication, and commitment greatly contributed to the development of the organization and the accomplishment of its mission, earning the respect and gratitude of his colleagues and fellow Cyber Warriors.

As DPC Anisco PN officially concludes his active naval service, ETC Raymon P Amorada PN assumes the position and responsibilities of Acting MCPO, CWF, PN (P), ensuring the continuity of the duties and responsibilities While he may be retiring from the service, the legacy he built through years of sacrifice, dedication, and faithful service will remain part of the CWF, PN (P)family and continue to inspire those who follow in his footsteps.

The CWF, PN (P) family extends its deepest appreciation and heartfelt gratitude to DPC Frederic A. Anisco PN for his decades of invaluable service and contribution to the Force and the Navy. As he begins a new chapter beyond active naval duty, the Force wishes him and his family continued good health, lasting happiness, peace, and fulfillment. His duty may have come to an end, but the legacy of his service will always remain.

𝗙𝗮𝗶𝗿 𝘄𝗶𝗻𝗱𝘀 𝗮𝗻𝗱 𝗳𝗼𝗹𝗹𝗼𝘄𝗶𝗻𝗴 𝘀𝗲𝗮𝘀, 𝗘𝗡𝗦 𝗙𝗥𝗘𝗗𝗘𝗥𝗜𝗖 𝗔 𝗔𝗡𝗜𝗦𝗖𝗢 𝗣𝗡!

-N Ceremony

02/10/2026

𝗖𝗬𝗕𝗘𝗥𝗦𝗘𝗖𝗨𝗥𝗜𝗧𝗬 𝗔𝗗𝗩𝗜𝗦𝗢𝗥𝗬 | 𝗔𝗜-𝗚𝗘𝗡𝗘𝗥𝗔𝗧𝗘𝗗 𝗜𝗗𝗘𝗡𝗧𝗜𝗧𝗜𝗘𝗦

Hindi lahat ng nakikita online ay tunay. Minsan, ang banta ay nagmumukhang taong pinagkakatiwalaan natin.

Sa panahon ng Artificial Intelligence (AI), ginagamit ito ng ilang cyber threat actors upang lumikha ng pekeng organisasyon, consultancy firms, research groups, at synthetic online identities na mukhang lehitimo. Layunin nitong makakuha ng sensitibo at non-public information at makabuo ng access sa professional networks.

MAG-ISIP. MAG-VERIFY. MAG-INGAT.

Bago mag-accept ng connection, mag-reply sa mensahe, o makipag-ugnayan sa isang hindi kilalang indibidwal o organisasyon:

Suriin ang email domain, website, contact information, at claimed affiliations.
Mag-ingat sa mga profile o organisasyong bago, generic, o hindi tugma ang impormasyon.

Huwag magbahagi ng non-public assessments, internal views, draft positions, o operational details.

I-report ang kahina-hinalang profile, domain, o mensahe sa inyong Unit C4ISR Office para sa validation at monitoring.

VERIFY FIRST!

Sa panahon ng AI at patuloy na nagbabagong cyber threats, hindi sapat na mukhang tunay—kailangan itong mapatunayan.

Maging mapanuri. Protektahan ang impormasyon. Panatilihin ang Operational Security (OPSEC).

Think Before You Click.
Verify Before You Trust.
Stay Cyber Aware.

(90)

28/09/2026

CYBER ALERT | TinyRCT Backdoor Powering Cyber Espionage in Southeast Asia

Cybersecurity researchers have uncovered a sophisticated cyber espionage campaign involving a Chinese-speaking Advanced Persistent Threat (APT) group deploying a newly discovered backdoor called TinyRCT against government and state-owned energy organizations in Southeast Asia. The malware enables attackers to remotely control compromised systems, steal sensitive files, capture screenshots, and maintain long-term access while avoiding detection. The campaign highlights the persistent threat posed by nation-state actors targeting critical infrastructure and emphasizes the importance of proactive cyber defense.

Key Facts
• Researchers attributed the activity to a Chinese-speaking threat cluster tracked as CL-STA-1062.
• The campaign primarily targets government agencies and state-owned energy organizations in Southeast Asia.
• Attackers utilize a newly identified custom backdoor named TinyRCT.
• TinyRCT enables remote command ex*****on, file theft, screenshot capture, and persistent remote access.
• The operation demonstrates characteristics commonly associated with long-term cyber espionage campaigns designed to gather intelligence while remaining hidden.

Red Flags to Watch For
• Unusual outbound connections to unfamiliar external servers.
• Unexpected remote command ex*****on or unauthorized administrative activities.
• Unknown processes running persistently in the background.
• Sudden creation or modification of scheduled tasks or startup entries.
• Suspicious file access or unexplained screenshot and data collection activities.
• Security tools generating repeated alerts for abnormal network behavior.

Recommendations
• Keep operating systems and applications fully patched and updated.
• Implement Endpoint Detection and Response (EDR) solutions to identify malicious activity.
• Continuously monitor network traffic for unusual outbound communications.
• Apply the principle of least privilege to reduce unauthorized access.
• Conduct regular threat hunting and log analysis to detect indicators of compromise.
• Strengthen multi-factor authentication (MFA) and network segmentation for critical systems.
• Educate personnel on cybersecurity best practices and reporting suspicious activity promptly.

Advanced Persistent Threats continue to evolve by deploying custom malware specifically designed to evade traditional security measures and maintain long-term access to targeted networks. Organizations must remain vigilant through layered security, continuous monitoring, and timely incident response to protect critical information and national infrastructure from emerging cyber threats.

28/09/2026

CYBER ALERT: FAKE ADOBE & ZOOM UPDATES

Cybersecurity researchers have uncovered an active campaign dubbed SMOKE , where attackers use fake Adobe and Zoom updates, business documents, and other software-related lures to trick users into executing malicious files. The campaign ultimately installs ConnectWise ScreenConnect, a legitimate remote-management tool that is abused by attackers to establish persistent remote access to compromised computers.

This campaign demonstrates how cyber threats can hide behind familiar software, trusted cloud platforms, and seemingly routine workplace activities. A legitimate application can become a security risk when attackers manipulate users into installing or running it without authorization.

KEY FACTS
• The campaign is identified as SMOKE .
• Attackers use fake Adobe and Zoom update notifications as phishing lures.
• Business-related documents and system-maintenance themes are also used to deceive users.
• The attack chain can involve VBScript droppers, batch scripts, .NET executables, PowerShell, and malicious MSI files.
• Attackers abuse trusted services, including Dropbox and Cloudflare, to deliver or stage malicious content.
• Successful infections lead to the installation of ScreenConnect, allowing attackers to establish persistent remote access.
• Attackers may attempt to weaken security protections such as AMSI, SmartScreen, and Windows Defender.

MALICIOUS SOFTWARE AND TOOLS IDENTIFIED
• ScreenConnect – legitimate remote-management software abused to maintain persistent remote access to compromised systems.
• VBScript droppers – used to initiate the infection and download additional payloads.
• PowerShell payloads – used to retrieve and execute malicious code.
• Malicious .NET loaders/executables – used to stage and execute the next phase of the attack.
• Malicious MSI installers – used to install the ScreenConnect client.
• Batch scripts – used to modify security settings and facilitate ex*****on.
• cloudflared.exe – a legitimate Cloudflare utility observed being used as part of the attackers' infrastructure and tunneling activity.

WARNING SIGNS
• Unexpected Adobe, Zoom, or software-update notifications received through email or web pages.
• Links directing users to download updates from unfamiliar websites or file-sharing services.
• Unexpected MSI, EXE, BAT, VBScript, or other executable files attached to emails or documents.
• Requests to disable antivirus, SmartScreen, or other security controls.
• Unexpected User Access Control (UAC) administrator prompts during supposedly routine software updates.
• Appearance of an unfamiliar remote-management or remote-access application on a workstation.
• Suspicious PowerShell or cmd.exe activity following the opening of an email attachment or downloaded file.

RECOMMENDATIONS
• Never install software updates from unsolicited email links or attachments.
• Download updates only from the software vendor's official website or approved organizational repositories.
• Verify unexpected update requests with your IT or cybersecurity personnel.
• Restrict the ex*****on of untrusted MSI, EXE, BAT, and script files.
• Monitor and audit the authorized use of Remote Monitoring and Management (RMM) tools such as ScreenConnect.
• Monitor suspicious PowerShell and command-line activity.
• Maintain endpoint security controls and investigate attempts to disable or tamper with security protections.
• Enforce appropriate UAC and application-control policies to prevent unauthorized administrative actions.
Cyber attackers do not always use obviously malicious software or suspicious websites; they can disguise their activities as routine software updates and legitimate business processes. Think before you click, verify before you install, and report suspicious activity immediately, because one seemingly harmless update can provide attackers with persistent access to your system.

25/09/2026

LOOK | “LIGHT THE WORLD IN BLUE” LIGHTING THE WAY FOR A STRONGER MARITIME FUTURE

24 September 2026, the Cyber Warfare Force, Philippine Navy (CWF,PN (P)) joins the global maritime community in the observance of World Maritime Day 2026 through the “Light the World in Blue” initiative.

Illuminated in blue, the Force highlights its solidarity with the maritime community and the importance of promoting safe, secure, environmentally sound, and efficient shipping. As part of the Philippine Navy and a nation surrounded by vast maritime spaces, CWF,PN (P) supports initiatives that strengthen maritime awareness, unity, and responsibility.

The activity also forms part of the observance of Maritime and Archipelagic Nation Awareness Month (MANA MO) this September.

One Maritime Community. One Blue Horizon. One Shared Responsibility.

-N(P)