During a Sept. 22 press briefing, Department of Information and Communications Technology (DICT) secretary Henry Aguda said Anonymous Philippines was linked to the Sept. 21 protests in Manila, where masked demonstrators in black were involved in clashes at Recto and Mendiola.
According to Aguda, the “Black Mask March” was started by the Anonymous Philippines. He tagged them as having initiated the callout online to wear black clothes and masks during the protest.
On Sept. 14, one of the Anonymous Philippines social media pages posted a video stating:
“Greetings, citizens of the Philippines. We are anonymous. Calling on all brothers and sisters to gather at Luneta Park on Sept. 21st. Bring your own mask. We are supporting Filipinos against corruption. It’s time to ignite the fire and make a change. Justice for the Filipino taxpayer, for the future of our children. We are your co-worker. Your co-student. Your neighbor. We are just simple citizens like you seeking a change for a better future of this country. We are anonymous. We are legion. We do not forgive. We do not forget. Expect us.”
During the incidents, protesters threw bottles, debris, and reportedly molotov cocktails at policemen, and engaged in looting, destruction of property, burnings, and vandalism. At least 2 people died from the events and multiple people were seriously injured.
Anonymous Philippines social media pages claimed innocence and said they advocated for a peaceful march. One of them placed the blame on the Communist Party of the Philippines – New People’s Army (CPP-NPA) for the violence that occurred. It cited the presence of individuals wearing hammer and sickle emblems, which they showed footage of in a video statement:
“Greetings citizens of the Philippines and to DICT Sec. Henry Aguda
We are Anonymous Philippines,
We just want to make things clear about what happened yesterday at Mendiola.
We anonymous Philippines joined in the Peaceful protest at Luneta Park after our Operation #FeedTheHomeless and March towards Mendiola Peaceful Arch at 1 PM.
After the interview with GMA News, We peacefully leave the place and did our part in the protest in some other ways.
We condemned violence!
What happened yesterday was a hijacking of the event, We noticed some members of CPP NPA wearing some communist logo on their shirt @ Luneta earlier. Same people who started the violence at the Ayala Bridge.
CPP NPA took the advantage of the event to do their black intentions and started the ” BLACK MARCH PROTEST” They are the one who’s responsible of destruction of public and private properties in Manila during the protest, they wanted to set fire at Malacañang Palace.
Red tagging Anonymous Philippines will nothing to do about current situation of our country, the real enemy is in the line of the government not in the people who seeking change for this country.
We remain watchful and committed to nonviolence.”
Another Anonymous Philippines member, pr.is0n3r, made the following statement:
“To our fellow Filipinos: We wish to make it clear that Anonymous Philippines had no involvement in any acts of violence that occurred during the rally on Sept. 21, 2025. We were not present, nor are we connected to the small group of youths involved. They are not members of our community and do not belong to our circles.
Based on our preliminary review, there appear to be individuals who were financed to instigate trouble. Video materials show money being divided prior to the disturbance. We urge the relevant authorities to conduct a thorough investigation into this matter.
With respect to the DICT and reports of government website defacement: We were not involved. We call for a proper and comprehensive investigation to inform the public of the facts. Throughout these events, Anonymous Philippines remained silent and did not interfere.
We categorically reject violence and disorder as means to achieve any objective. We refuse to pursue “solutions” to national issues through violence or chaos, and instead stand for peaceful, responsible, and constructive engagement.
For clarity and accuracy, we are willing to cooperate with any legitimate investigation.”
One social media user commented on one of the Anonymous Philippines posts: “sunogin ang malacnyng … Sunod bahay nga mga buwaya ..dapat ng kumilos pra matakot na mga buwaya”
It is to be noted that the Anonymous hacktivist movement is decentralized and is composed of individuals of varying ideologies and motivations.
Meanwhile, attacks have continued on government websites, as reported by the cybersecurity research and advocacy group Deep Web Konek (DWK). They documented at least 50 cyber attacks between Sept. 20 and 23 coinciding with protests, with more occurring after.
During the day of the protest, pr.is0n3r posted: “Yung iba nasa luneta habang Yung iba binebembang na Yung mga gov.sites.
Sa mga nagde deface wag na wag kayong mag lalagay Ng cn sa mga greetings niyo wag niyo Silang bigyan Ng idea kung sino sino kayo para safe Ang lahat. Happy bembang day.”
The gray hat actor Klammer from Deathnote Hackers stated that on Sept. 20, that they had put out a call for everyone to “show what they’ve got on the 21st”, and that everyone delivered with defacements, DDoS attacks, leaks, and even hidden exfiltration in the background.
On Sept. 21, DWK detected an alleged breach posted by an actor named Dedsec_Manila on an underground forum involving the eComplaints system of the eGov PH platform of the DICT.
Named after the fictional hacking group DedSec from the Ubisoft hacker video game series Watch Dogs, the actor claimed to have obtained more than 30,000 records from the database.
The DICT released a statement the day after that the incident involved a third-party system that was integrated, but managed separately from eGov PH, and that the eGov App itself was not hacked or compromised.
Multiple government websites were attacked during the period, many from LGUs and regional offices like in Zamboanga, Laguna, DepEd and DPWH. Multiple government web systems were also hit with Distributed Denial of Service (DDoS) attacks, rendering them inaccessible to the public.
A large number of LGU websites that were defaced appear to be hosted on the same web server, as they all shared the same IP address. The compromise of one site may have allowed the hackers to enter and deface the rest of the websites on the server.
The probes and attacks continue. Just yesterday, the hacktivist Klammer showed a screenshot of what appeared to have been an exploit of a path traversal vulnerability with a Philippine Statistics Authority portal to access a cryptographic private key, and another screenshot of the portal being down.
A post by pr.is0n3r on Sept. 22 stated: “Hanggang November 5 daw bebembangin Yung mga gov. Sites Agay.”, a reference to Guy Fawkes Night line “Remember, remember, the fifth of November” that was popularized by the movie V for Vendetta, from where the Anonymous movement takes its iconic mask.
