ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
A Chinese-speaking threat actor exploited a critical vulnerability in ownCloud to steal sensitive nuclear records from a Philippine research body. The attacker used custom Python scripts and open-source tools to gain unauthorized access, exfiltrating data including nuclear-material account records, strategic plans, and employee information. The intrusion was linked to a marine engineering and shipbuilding company providing services to the Philippine Navy, and involved a separate WordPress site compromise leveraging a LiteSpeed Cache plugin vulnerability. The incident highlights a deliberate targeting of Philippine defense-related organizations.
A Chinese-speaking threat actor exploited a critical vulnerability, CVE-2023-49105 (CVSS score: 9.8), in ownCloud to steal nuclear records from a Philippine research body. The vulnerability, a WebDAV API authentication bypass, allowed an attacker to access, modify, or delete files without authentication if the victim’s username was known and no signing key was configured – a default configuration. Disclosed by ownCloud in November 2023, the flaw impacted core versions from 10.6.0 through 10.13.0 and was fixed in version 10.13.1.
Hunt.io identified an open directory on the host "31.58.209[.]241" staging custom Python scripts, including open-source offensive security tooling such as Sliver, Metasploit, and Mettle, and exfiltrating data from two Philippine organizations, including the nuclear research body and a marine engineering and shipbuilding company providing services to the Philippine Navy. The operator used pre-signed URLs generated with an empty signing secret to target an ownCloud instance operated by the nuclear research body, bypassing authentication.
Five custom Python scripts were found to exploit CVE-2023-49105, allowing an attacker with valid usernames to obtain unauthorized access without credentials. Four scripts targeted a single account, while the fifth script enumerated the WebDAV directory and logged every download attempt. In total, the attacker downloaded 176 files totaling approximately 372 MB, including nuclear-material account records, draft strategic plans covering 2023 through 2028, research reactor core components, historical fuel inventories, and presentation material, employee personal information, and a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database, along with credentials stores like BitLocker keys, a KeePass database, and AxCrypt-encrypted files.
Separately, a WordPress site managed by the marine engineering firm was compromised via a LiteSpeed Cache plugin vulnerability (CVE-2024-28000, CVSS score: 9.8). A Python script ("brute_xmlrpc.py") was used to conduct an XML-RPC brute-force attack, attempting to guess account credentials and provide an alternative pathway to access the site independent of the ownCloud vulnerability. Further analysis of the WordPress source code revealed an active, possibly unrelated compromise leveraging EtherHiding to extract HTML content from an Ethereum smart contract and ultimately serve a Google verification page, part of a ClickFix-style attack. The lure involved invoking "mshta.exe" and downloading a Visual Basic Script (VBScript) dropper ("pcalua.exe").
Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by August 30, 2026. CISA has also added two other vulnerabilities – Linux Kernel (CVE-2026-53362) and Artifactory (CVE-2026-66384) – to its Known Exploited Vulnerabilities catalog, following OpenAI’s revelation of exploiting these flaws to target its internal infrastructure.