Suspected Chinese-speaking operators exploited the critical ownCloud flaw CVE-2023-49105 to steal nuclear material records, research reactor data, personnel files, and encryption key material from a Philippine nuclear research organization.
Hunt.io discovered an exposed file directory on August 13, 2026, hosted at 31.58.209[.]241:8000, an Amsterdam-based server registered to CGI Global Limited.
The directory was served through Python’s SimpleHTTP module and contained 1,310 files across 86 subdirectories, including custom exploit scripts, exfiltration logs, offensive tooling and stolen data.
Hunt.io disclosed the findings to CERT-PH under TLP:AMBER and delayed publication until August 25 while the national incident response body coordinated notifications.
The exposed infrastructure contained an ownCloud deployment on port 80, which researchers assess may have served as a controlled environment for testing the pre-signed URL bypass.
Other observed services included SSH on port 22, a Python HTTP listener on port 8080, and an unexplained TCP service on port 54329.
CVE-2023-49105 affects ownCloud installations using the platform’s pre-signed URL mechanism without a configured signing secret.
Under that condition, the application processes signatures with an empty secret, allowing attackers who know a valid username to generate forged WebDAV requests that are accepted as authenticated requests for that account.
The operators’ recovered Python scripts implemented this technique against the nuclear agency’s internet-facing ownCloud server.
The scripts set the OC-Credential parameter to a target account, create a valid signature using the empty secret, and retrieve material through the /remote.php/dav/files/
Four scripts focused on individual accounts, while a fifth used PROPFIND requests to enumerate directories and recursively identify files.
The code deliberately inserted random delays of roughly 1.5 to six seconds between requests, consistent with an attempt to reduce traffic volume and evade simple detection thresholds.
Simplified Chinese comments and docstrings described collection objectives such as “low-speed download of nuclear material documents,” radiation-safety files and IT-planning data.
Five staging directories associated with the nuclear organization contained 176 files totaling approximately 372 MB.
The recovered material included research-reactor core-component databases, historical fuel inventory records, radiation-safety documentation, authorized-user lists, incident-reporting material and draft safety manuals.
The operators also collected strategic plans, IT documents, finance-related files, service requests, résumés, passport-related documents, foreign-travel records, personal data sheets and Philippine government financial-disclosure forms.
A credential archive included a KeePass database, AxCrypt-encrypted files and a BitLocker recovery key.
An attacker-created CSV suggested the visible collection represented only a portion of the intrusion.
It recorded roughly 9 GB of data as exfiltrated from the nuclear agency and listed ministry-related infrastructure, credentials, a confirmed ownCloud login pair and access to a project-management system.
The discrepancy between the CSV and the remaining staged data indicates that additional content may have been removed before Hunt.io observed the server.
Hunt.io Researchers said that, the activity also included the compromise of a Philippine marine engineering and shipbuilding company that supports the Philippine Navy.
Researchers also recovered a 192 MB SQL dump from ZKTeco BioTime, an attendance and personnel-management platform.
CVE-2023-49105 Flaw Exploited
The database reportedly contained records involving affiliated Philippine science and research organizations, potentially providing badge mappings, departmental information and access-history data useful for follow-on targeting.
A separate directory held a full WordPress archive and SQL database dump from a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.
The operator used CVE-2024-28000, an unauthenticated privilege-escalation flaw in LiteSpeed Cache versions through 6.3.0.1, to create a WordPress administrator account. The flaw was fixed in version 6.4.
A second tool targeted the site’s XML-RPC endpoint with wp.getUsersBlogs authentication attempts using the RockYou password list. Logs showed that this path also obtained a valid credential pair, giving the intruder redundant access routes.
The WordPress archive additionally contained an apparently separate EtherHiding-style compromise.
Injected JavaScript queried an Ethereum smart contract to retrieve and render malicious content resembling a Google verification page, then used a ClickFix lure to push victims toward executing a command that launches mshta and downloads a VBS payload.
Hunt.io identified 174 IP addresses hosting pages with similar NoChain loader indicators.
Hunt.io assessed with medium confidence that the operation reflected targeted intelligence collection rather than indiscriminate exploitation.
The deliberate selection, Chinese-language categorization and structured retrieval of nuclear, personnel and defense-adjacent material support that assessment, although the researchers did not attribute the activity to a named threat group.
The campaign emerges amid sustained cyber-espionage pressure on Philippine government, defense and academic organizations.
Microsoft’s 2025 Digital Defense Report described China’s broad espionage activity and data-theft operations across sectors, while reporting increased targeting in Southeast Asia.
Organizations running ownCloud should upgrade to version 10.13.3 or later and configure a strong signing secret.
WordPress administrators should update LiteSpeed Cache, restrict or disable XML-RPC where it is unnecessary, enforce MFA, rotate exposed credentials and investigate WebDAV logs for unusual PROPFIND activity or cross-account file retrieval.
IOCs
| Filename | Context | Hash |
|---|---|---|
| multi_backupd | Stage 1 loader on open directory | 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82 |
| stage2_payload.bin | Retrieved from 31.58.209[.]241:8090 | 10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
