A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a marine engineering company that supports the Philippine Navy, using well-known vulnerabilities in internet-facing ownCloud and WordPress systems. The activity was uncovered after Hunt.io found an exposed server in Amsterdam that contained attack scripts, logs, offensive tooling and data taken from the two organisations.
“Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations.” reads the report published by Hunt.io. “A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim.”
Hunt.io disclosed the findings to CERT-PH under the TLP:AMBER sharing standard and delayed publication until 25 August 2026 so the national response team could notify the affected organisations. The incident arrives amid sustained tensions in the South China Sea and continuing reports of suspected Chinese cyber activity against Philippine government, defence and critical-infrastructure targets.
“On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV.” states the report.”A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.”
The server was not a sophisticated hidden service. It exposed a Python SimpleHTTP directory on port 8000, along with SSH, a self-hosted ownCloud login page and other services. The directory contained 1,310 files in 86 folders, totaling 1.17 GB, including scripts, stolen data and tools such as Sliver, Metasploit and Mettle.
Researchers gained a rare view of the attacker’s operations after finding tools, logs and stolen files left exposed on the server. The main entry point was likely the nuclear research body’s internet-facing ownCloud service, compromised by exploiting CVE-2023-49105, an authentication-bypass flaw in ownCloud versions before 10.13.1.
In this condition, an attacker who knows a valid username can generate WebDAV requests that the server accepts as if they were made by that user. No password is needed. Hunt.io found five custom Python scripts implementing this technique, four focused on individual accounts and a fifth capable of enumerating directories and recording every attempted download. hunt
“In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.” continues the report. “A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging.”
The attacker used random delays to make data collection less noticeable and avoid volume-based alerts. Scripts, logs and folders consistently used Simplified Chinese, including labels for nuclear, radiation-safety, finance and IT files. This suggests a Chinese-speaking operator, but does not prove links to a specific government or threat group.
The stolen data included nuclear reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists. It also included strategic plans, IT documents, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials.
The exposed server held 176 files, about 372 MB in total. However, a CSV created by the attacker referred to roughly 9 GB of stolen data. This gap suggests the server contained only part of the haul and that the attacker may have accessed much more than researchers could recover.
The material also included a KeePass database, AxCrypt-encrypted files and a BitLocker recovery key. Those artefacts matter because they can support follow-on access: a data theft operation can become a credential-theft operation, and a credential-theft operation can become a longer-term intrusion.
Researchers additionally recovered a 192 MB SQL dump from a ZKTeco BioTime attendance and personnel system. Such a database can link people to badge identifiers, departments and access records, enabling an attacker to build a picture of who works where, who may have sensitive access and which people are worth targeting next.
The same server also contained evidence of a breach involving a Philippine marine engineering and shipbuilding company that works with the Philippine Navy. The attacker exploited CVE-2024-28000, a privilege-escalation flaw in the LiteSpeed Cache WordPress plugin.
The flaw let attackers create a WordPress admin account without authentication by exploiting a predictable security hash through the REST API. Hunt.io found the exploit code, compiled tools and logs showing that the attacker successfully gained admin access.
The attacker also used WordPress XML-RPC to test passwords for the admin
account with the well-known rockyou.txt
list. The logs show that this method also found valid credentials.
That gave the operator redundancy. Even if one access path were closed, the attacker could retain an administrator account, a valid password or data such as WordPress hashes and secret values from the stolen site database. Redundant access is not glamorous. It is, unfortunately, effective.
While examining the compromised WordPress site, Hunt.io also discovered an active EtherHiding-style injection that it believes may be unrelated to the Chinese-speaking operator. The malicious JavaScript used an Ethereum smart contract as a place to retrieve content, then displayed a fake Google verification page designed to push visitors into a ClickFix-style infection flow.
The campaign used a service worker for persistence and collected visitor fingerprint data. Hunt.io found 174 unique IP addresses hosting pages with the same NoChain loader strings and smart-contract reference, but said the evidence did not link that activity to the operator who attacked the nuclear and naval-linked targets.
That distinction matters. A compromised website can host multiple intrusions or payloads at once, often run by unrelated actors. Analysts should resist the temptation to treat every malicious artefact on one server as evidence of a single campaign.
The technical lesson is blunt: old and known weaknesses still provide access to high-value targets. Organisations using ownCloud should upgrade to version 10.13.3 or later, apply the vendor’s relevant fixes and ensure that pre-signed URLs use a strong, non-empty signing key.
Teams should also examine WebDAV logs for suspicious PROPFIND
directory-enumeration requests, large volumes of file retrieval across multiple accounts, or recurring requests from a single source with artificial gaps between them. Low-and-slow collection is still collection.
For WordPress, organisations should update LiteSpeed Cache to version 6.4 or later, remove or restrict XML-RPC when it is not needed, enforce strong unique administrator passwords and require multi-factor authentication. The XML-RPC compromise in this case succeeded against a password from a public wordlist, which is not a vulnerability in WordPress so much as an invitation nobody should leave on the doorstep.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Philippine nuclear and naval targets)