Chinese-Speaking Hackers Exploit ownCloud and WordPress Flaws to Target Philippine Nuclear and Naval Entities
A suspected Chinese-speaking threat actor exploited unpatched vulnerabilities in ownCloud and WordPress to steal sensitive data from a Philippine nuclear research agency and a marine engineering firm linked to the Philippine Navy. The campaign, uncovered by Hunt.io on August 13, highlights the risks of exposed internet-facing systems in organizations handling national-security data.
Attack Details
The intrusions leveraged two critical flaws:
-
ownCloud (CVE-2023-49105) – An authentication bypass in the platform’s pre-signed link feature allowed attackers to access files via WebDAV requests without credentials. The nuclear agency’s self-hosted ownCloud instance was compromised using five custom Python scripts, which systematically downloaded files while evading detection with randomized delays.
- Stolen data included:
- Reactor core component databases
- Fuel inventory and radiation-safety records
- Staff resumes, travel logs, and financial disclosures
- Encrypted credential stores (KeePass, AxCrypt) and a BitLocker recovery key
- Files were organized in simplified Chinese-labeled folders, suggesting the operator’s linguistic background.
- Stolen data included:
-
WordPress (CVE-2024-28000) – The marine engineering firm’s site was breached via a flaw in the LiteSpeed Cache plugin (versions <6.4), enabling attackers to create a rogue administrator account through the REST API. The exploit ran for nearly 4 hours before succeeding.
- Stolen data included:
- Full WordPress installation (195 MB)
- Database dump and media library
- Successful admin credentials (obtained via XML-RPC brute-forcing)
- The site was also found hosting an unrelated EtherHiding-style malware (fake verification pages delivering VBS droppers), though no direct link to this campaign was established.
- Stolen data included:
Scope and Impact
- Nuclear agency: ~9 GB of data was exfiltrated, though only 372 MB (176 files) were recovered from the exposed staging server.
- Marine engineering firm: Attackers archived the entire WordPress site, including password hashes, plugin settings, and site secrets, granting persistent access.
- Attribution: Hunt.io identified Chinese-language artifacts but did not attribute the activity to a known group.
Technical Indicators
The exposed server (31.58.209[.]241:8000) contained attack tools, transfer logs, and stolen files. Additional IoCs include:
- Stage-one ELF loader:
multi_backupd(SHA-256:7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82) - Stage-two payload:
stage2_payload.bin(SHA-256:10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1) - EtherHiding artifacts: Fake verification domains (
fine-work-team[.]com,timelevel12[.]com) and an Ethereum smart contract (0x58460d0b3d4d6b03761c89120393c0c676676496).
The incident underscores the need for timely patching, credential hygiene, and monitoring of WebDAV and REST API activity in critical infrastructure.
Source: https://cybersecuritynews.com/hackers-exploit-owncloud/
Aries Marine Corporation cybersecurity rating report: https://www.rankiteo.com/company/aries-marine-corporation
Philippine Nuclear Research Institute cybersecurity rating report: https://www.rankiteo.com/company/philippine-nuclear-research-institute
"id": "ARIPHI1787841291",
"linkid": "aries-marine-corporation, philippine-nuclear-research-institute",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Nuclear Research',
'location': 'Philippines',
'name': 'Philippine nuclear research agency',
'type': 'Government Agency'},
{'industry': 'Marine Engineering/Defense',
'location': 'Philippines',
'name': 'Marine engineering firm linked to the '
'Philippine Navy',
'type': 'Private Company'}],
'attack_vector': ['Exploitation of unpatched vulnerabilities',
'WebDAV requests',
'REST API abuse'],
'data_breach': {'data_encryption': 'Partial (KeePass, AxCrypt, BitLocker)',
'data_exfiltration': True,
'file_types_exposed': ['Databases',
'Documents',
'Credentials',
'Media files'],
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (national-security, personally '
'identifiable information)',
'type_of_data_compromised': ['Reactor core component '
'databases',
'Fuel inventory and '
'radiation-safety records',
'Staff resumes, travel logs, and '
'financial disclosures',
'Encrypted credential stores '
'(KeePass, AxCrypt)',
'BitLocker recovery key',
'WordPress database dump',
'Media library',
'Admin credentials']},
'date_detected': '2024-08-13',
'description': 'A suspected Chinese-speaking threat actor exploited unpatched '
'vulnerabilities in ownCloud and WordPress to steal sensitive '
'data from a Philippine nuclear research agency and a marine '
'engineering firm linked to the Philippine Navy. The campaign, '
'uncovered by Hunt.io on August 13, highlights the risks of '
'exposed internet-facing systems in organizations handling '
'national-security data.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': '~9 GB (nuclear agency), 195 MB (marine '
'engineering firm)',
'identity_theft_risk': 'High (staff resumes, travel logs, '
'financial disclosures)',
'operational_impact': 'Potential compromise of national-security '
'data',
'systems_affected': ['ownCloud instance', 'WordPress site']},
'investigation_status': 'Ongoing',
'lessons_learned': 'Need for timely patching, credential hygiene, and '
'monitoring of WebDAV and REST API activity in critical '
'infrastructure.',
'motivation': 'Espionage, Data Theft',
'post_incident_analysis': {'corrective_actions': ['Apply security patches',
'Implement monitoring for '
'critical systems',
'Enforce credential '
'hygiene'],
'root_causes': ['Unpatched vulnerabilities '
'(CVE-2023-49105, CVE-2024-28000)',
'Exposed internet-facing systems',
'Lack of monitoring for WebDAV and '
'REST API abuse']},
'recommendations': ['Patch vulnerable systems immediately',
'Monitor WebDAV and REST API activity',
'Implement credential hygiene practices',
'Enhance monitoring of critical infrastructure'],
'references': [{'source': 'Hunt.io'}],
'response': {'third_party_assistance': 'Hunt.io'},
'threat_actor': 'Suspected Chinese-speaking threat actor',
'title': 'Chinese-Speaking Hackers Exploit ownCloud and WordPress Flaws to '
'Target Philippine Nuclear and Naval Entities',
'type': ['Data Breach', 'Espionage'],
'vulnerability_exploited': ['CVE-2023-49105 (ownCloud)',
'CVE-2024-28000 (WordPress LiteSpeed Cache '
'plugin)']}