Exposed Staging Server Reveals Transfer of Philippine Agency-Linked Backups and GodPotato Tooling

Summary

Hunt.io found logs showing a 68.837 GiB transfer of backups named for Philippine overseas-employment systems. An exposed server also held a rebranded GodPotato payload; the backup source and payload execution remain unconfirmed.

Key points

A transfer log recorded the completed copying of 27 SQL Server backups on September 6, 2026, but did not identify the source host or destination.
Backup filenames corresponded to Philippine overseas-employment systems, but researchers did not examine their contents or confirm the organization from the backups.
An unauthenticated directory on 213.163.205.35 exposed transfer and access logs, payloads, a PowerShell stager and an Impacket environment.
The rebranded GodPotato payload was designed to impersonate a SYSTEM client through a named pipe and duplicate a token; researchers did not observe it executing.
The PowerShell stager assembled base64 fragments in memory and loaded the resulting .NET assembly without writing a DLL to disk.
Certificate and domain records linked two addresses that retrieved tooling to agency portals, but the logs do not establish who requested the files or whether they ran them.
Hunt.io found no initial access vector, confirmed payload execution or attribution to a tracked actor, and notified the relevant national CERT before publication.

Article Details

Attack Vectors: The initial access vector is unknown. Transfer logs record a completed copy of 27 database backups, but do not identify the source host, destination, or transfer channel.
An unauthenticated HTTP directory on an operator-controlled staging server distributed a PowerShell stager and two rebranded GodPotato payloads. Retrieval was logged, but execution was not confirmed.
The staged stager can reconstruct a .NET payload from base64 fragments in memory. The payload can impersonate a SYSTEM client and run a command using a duplicated token.
Defensive Notes: The payload's named pipe, command-file path, fragment pattern, and completion markers are potential host artifacts; their presence or execution on agency hosts was not established.
The payload restores the RPC function pointer but leaves the modified memory page writable.
The POTATO_FIRED marker indicates only that the stager reached its final line, not that privilege escalation succeeded.

Indicators of compromise

Type	Indicator	Context
IPV4	`213[.]163[.]205[.]35`	Operator-controlled staging host serving the payloads, stager, toolkit, and logs through an open HTTP directory.
SHA256	`0405d4f79a3cc97fa492f1957cde0d51bc569f5432792f1b8f72077aa3fb2434`	Second build of the rebranded GodPotato payload, Wrqsnx_portal.dll.
SHA256	`4188295ae1f7f8a99d15e90eb037eef3eb03f6acd4422bf877c6e3304e70fcb9`	First build of Wrqsnx.dll, the rebranded GodPotato payload.
SHA256	`9d3f2f6031ec3b487ae12dd6f9311dd89b4a6bd23af252212bcc1f5507784f39`	Incomplete source archive for the operator's rebranded GodPotato payload.
SHA256	`cde477ef57ef6f100dcb0242f055113690fdeade8204e0986a3ad257be1fb81e`	Operator's upload.py receiver staged on the server; its use was not established.
SHA256	`fcbfc74ddffad4789120c618bdf166c6c8aaca286fb2d184f7fa0ed8b8f26c59`	PowerShell stager portalload.ps1, which reconstructs and loads the payload in memory.