A cybersecurity analysis has uncovered a breach targeting two Philippine government-adjacent organizations: a nuclear research agency and a marine engineering firm serving the Philippine Navy. An attacker, suspected to be Chinese-speaking, exploited known vulnerabilities in ownCloud and a WordPress plugin to steal reactor blueprints, employee data, planning documents, and more. The exposed cache of files was discovered on a publicly accessible server containing attack tools, logs, and manifested stolen content.
ownCloud exploited: authentication bypass & reactor data compromise
The nuclear agency’s ownCloud installation was compromised using CVE-2023-49105, a flaw tied to ownCloud’s pre-signed link functionality. When installations either lack a configured signing key or implement default or weak keys, attackers can bypass authentication and issue WebDAV requests impersonating valid users—without needing passwords.
Using five custom Python scripts, attackers downloaded files account by account, mapping directory structures via WebDAV requests and spacing out activity to evade detection. Among the data exfiltrated were core reactor component databases, fuel inventory logs, radiation safety reports, incident records, travel and financial disclosures, staff resumes, and credential stores encrypted via KeePass and AxCrypt. A BitLocker recovery key was also found. The stolen files were sorted into folders labeled in simplified Chinese, including categories like finance, radiation safety, and IT planning.
WordPress breach & plugin flaws widen the scope
On the naval contractor’s side, attackers leveraged CVE-2024-28000—present in versions of LiteSpeed Cache before 6.4—to create a rogue administrator account via the WordPress REST API. They derived the plugin’s internal security hash after over three hours and 45 minutes of automated brute-force, then added the new admin user.
The attackers also attempted password guessing against existing admin accounts via the site’s XML-RPC interface, successfully capturing credentials. They exfiltrated three archives totaling about 195 MB, containing the full WordPress installation, a database dump, and the media library. A separate EtherHiding-style malware infection was also detected on the same site, though investigators didn’t link it to the same actor.
Indicators & mitigation advice
Investigators discovered roughly 9 GB of data taken from the nuclear agency, though only about 372 MB—176 files—were accessible in the exposed server’s staging folders. This suggests much of the haul remains offline or hidden.
Identified IoCs include IP addresses and files such as the exposed server 31.58.209[.]241 on ports 8000 and 8090, loader files like multi_backupd, payload binaries, and fake verification pages serving VBS droppers, plus a telemetry endpoint used for fingerprinting.
To defend against similar attacks, operators are urged to upgrade ownCloud to version 10.13.3 or later and configure strong signing keys. WordPress sites should ensure LiteSpeed Cache is updated to version 6.4+, disable or limit XML-RPC if not needed, enforce strong and unique passwords, enable multi-factor authentication, and regularly audit admin accounts. Monitoring for WebDAV PROPFIND requests across multiple accounts is also advised.
This breach underscores the risk of leaving known vulnerabilities unpatched, especially in systems managing sensitive national-security data. Using default or weak configuration settings makes even today’s exploits accessible to less sophisticated actors. Agencies must treat updater patches, secure configurations, and threat-hunting tools not as optional, but as critical infrastructure. What to watch next: whether other nations’ nuclear or naval institutions are being probed via similar patterns, and whether this attacker escalates tactics or moves further into supply chains.
