Suspected Chinese-Speaking Operators Target Philippine Nuclear Facility
A critical vulnerability in the ownCloud platform, identified as CVE-2023-49105, has reportedly been exploited by suspected Chinese-speaking operators to access sensitive records pertaining to nuclear materials. The breach affected a nuclear research organization in the Philippines, leading to the unauthorized retrieval of research reactor data, personnel files, encryption keys, and more.
The breach came to light when Hunt.io discovered an exposed file directory on an Amsterdam-based server, specifically located at IP address 31.58.209[.]241:8000, on August 13, 2026. This server is associated with CGI Global Limited and was running Python’s SimpleHTTP module. The compromised directory contained an extensive collection of 1,310 files spread over 86 subdirectories. Among these were various custom exploit scripts, logs detailing exfiltration activities, offensive tools, and the stolen data itself.
Upon identifying the exposed infrastructure, Hunt.io promptly notified CERT-PH, the national incident response body in the Philippines, under a Traffic Light Protocol of AMBER. They chose to delay public disclosure of their findings until August 25 to allow the CERT-PH to coordinate necessary responses and notifications.
The vulnerability stemmed from the ownCloud installation’s failure to correctly configure a signing secret for its pre-signed URL mechanism. When an ownCloud installation lacks such a secret, the application erroneously processes signatures with an empty secret. This oversight permits attackers, if they know a valid username, to fabricate WebDAV requests that the server erroneously accepts as legitimate authenticated requests for that account.
Based on the evidence recovered by researchers, the operators employed Python scripts to initiate this exploit against the targeted nuclear agency’s publicly accessible ownCloud server. These scripts manipulated the OC-Credential parameter linked to specific accounts, generated a valid signature using the unprotected secret, and subsequently accessed sensitive materials through the WebDAV endpoint.
Further analysis of the scripts revealed that they were crafted to target individual accounts, with one script using PROPFIND requests to explore directories and recursively identify files. The attackers included intentionally placed random delays of between 1.5 to six seconds between requests, likely as a means to avoid triggering detection mechanisms that monitor traffic volume.
The comments within the code were written in Simplified Chinese and contained objectives explicitly mentioning “low-speed download of nuclear material documents,” as well as documents related to radiation safety and IT planning strategies. Within the attacked infrastructure, five directories associated with the nuclear organization housed 176 files, totaling around 372 MB. The compromised data included core-component databases of research reactors, historical fuel inventory records, authorized-user lists, incident reports, and drafts of safety manuals.
In addition to the nuclear-related data, the operatives also collected strategic planning documents, IT-related files, financial records, service requests, resumes, passport-related documents, foreign travel records, personal data sheets, and financial disclosure forms linked to the Philippine government. Among the compromised credentials was a KeePass database, along with AxCrypt-encrypted files and a BitLocker recovery key, indicating a broader strategy for data theft.
In an alarming sign, an attacker-generated CSV file indicated that the visible collection represented only a segment of the overall data exfiltration. This CSV detailed approximately 9 GB of data exfiltrated from the nuclear agency, along with credentials related to various ministry infrastructure and confirmed login pairs for the ownCloud system. The discrepancy between the CSV and the additional staged data implies that substantial content may have been purged prior to Hunt.io’s discovery of the server.
Researchers at Hunt.io also noted that the operations included an attack on a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy. During investigations, researchers retrieved a 192 MB SQL dump from ZKTeco BioTime, a platform used for attendance and personnel management, which contained data related to affiliated Philippine science and research organizations. This information may have included badge mappings and departmental access data, valuable for future targeting efforts.
Another segment of the compromised infrastructure revealed a complete WordPress archive and an SQL database dump from the marine engineering firm. The attackers leveraged CVE-2024-28000, an unauthenticated privilege escalation vulnerability in LiteSpeed Cache, to create a WordPress administrator account. Further exploitation attempts targeted the site’s XML-RPC endpoint, using the RockYou password list for authentication, successfully obtaining yet another valid credential pair.
Hunt.io’s findings indicate that the campaign was aimed at strategic intelligence gathering, rather than indiscriminate exploitation. This targeting is evidenced by the deliberate choice of information, the Chinese-language organization of the collected data, and the structured approach to retrieving materials connected to nuclear, personnel, and defense domains.
As ongoing cyber-espionage activities continue to press Philippine government agencies, defense organizations, and academic institutions, experts recommend urgent updates for organizations utilizing ownCloud to version 10.13.3 or later, along with robust configuration of a signing secret. Additionally, WordPress administrators are encouraged to update their LiteSpeed Cache, take measures to restrict or disable unnecessary XML-RPC usage, enforce multi-factor authentication, and routinely check for unusual activity in WebDAV logs.
In light of these revelations, it becomes increasingly crucial for organizations to bolster their cybersecurity measures, ensuring the protection of sensitive information from potential adversaries.