Chinese-Speaking Hackers Exploit Known Flaws to Steal Philippine Nuclear and Naval Data

Suspected Chinese-speaking operators walked through the front door of a Philippine nuclear research body's internet-facing ownCloud server using CVE-2023-49105, the WebDAV authentication bypass ownCloud disclosed on November 21, 2023 and fixed in core 10.13.1 after affecting 10.6.0 through 10.13.0 at CVSS 9.8. The flaw signs pre-signed URLs with an empty secret when no signing key is configured, the default state on new installs, so a request carrying OC-Credential, OC-Verb, OC-Expires, OC-Date, and an OC-Signature computed over an empty salt is accepted as any known username. Five custom Python scripts did exactly that against /remote.php/dav/files/, four targeting single accounts and one enumerating with PROPFIND Depth 1, spacing downloads with random 1.5 to 6 second gaps and logging each transfer to /root/oc_download.log. Hunt.io found the operator's staging box, a Python SimpleHTTP directory at 31.58.209[.]241:8000 in Amsterdam on CGI Global Limited (AS56971), on August 13, 2026, held disclosure to CERT-PH until August 25, and published the next day. The same server documents a second intrusion, a Philippine Navy marine engineering contractor's WordPress site, where a Go reimplementation of CVE-2024-28000 in LiteSpeed Cache ground through seeds 0 to 999999 for about three hours forty five minutes before landing on seed 311787 and minting an admin account, later joined by a rockyou.txt brute force of admin over XML-RPC.

The staged collection argues targeted espionage, not smash and grab. Staging folders sorted under simplified Chinese subject names hold research reactor core-component databases, nuclear material account records, radiation safety documents, a draft safety manual, strategic and IT plans covering 2023 through 2028, SALN financial disclosures, résumés, passport files, and foreign travel records, alongside a KeePass database, AxCrypt-encrypted files, a BitLocker recovery key, and a 192 MB ZKTeco BioTime attendance dump running through December 2024. That combination maps people to facilities, shifts, and authorizations, which is how a collector prepares follow-on access or personnel targeting rather than how a profit motive behaves. The detail the event list does not carry is the operator's own accounting: their CSV catalogs roughly 9 GB exfiltrated from the nuclear agency against the 372 MB actually visible on the directory, plus 38 recovered credential sets, one validated ownCloud password pair, and confirmed IDOR access with a successful file upload against a project-management application tied to the parent ministry. Read together, the pre-signed URL abuse may have been only one leg of a wider intrusion, with a third victim already touched and most of the haul never exposed on that server. A two-year-old, publicly documented, trivially misconfiguration-dependent bug still paying out against nuclear infrastructure in August 2026 is also the real headline: the adversary needed no zero-days, only an unpatched default.

The fixes are exact. Upgrade ownCloud to 10.13.3 or later and configure a strong, non-empty signing key on every deployment that uses pre-signed URLs; an unconfigured key is the entire exploit. Hunt in ownCloud and reverse-proxy access logs for WebDAV GET or PROPFIND requests to /remote.php/dav/files/ carrying the OC-Credential through OC-Signature parameter set, PROPFIND enumeration from a single source, or retrievals spread across many accounts with irregular short gaps, and treat any account with no signing key configured as exposed until proven otherwise. Block and pivot on 31.58.209[.]241, ports 8000 and 8090, and the published SHA-256 values for multi_backupd (7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82) and stage2_payload.bin (10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1). For the WordPress side, patch LiteSpeed Cache to 6.4 or later, disable /xmlrpc.php where the business allows it or restrict it to trusted sources, and audit for administrator accounts recently created through the REST API, since the LiteSpeed Cache path succeeded with a password found in a public wordlist.

Two developments would move this assessment. CISA added CVE-2023-49105 to the KEV catalog on August 27, 2026 with remediation due August 30, which invites opportunistic scanning of every exposed ownCloud instance, so wide exploitation telemetry would convert a two-victim espionage case into a broad patching emergency. Independent confirmation of a third victim from the attacker CSV's ministry infrastructure table, or attribution beyond Hunt.io's medium-confidence targeted-collection finding, would widen both the scope and the political weight of the intrusion.