Chinese Hackers Target Philippine Nuclear and Naval Data Using OwnCloud and WordPress Exploits
A suspected Chinese-speaking threat actor has successfully exfiltrated sensitive nuclear and naval data from Philippine organizations by exploiting vulnerabilities in ownCloud and a WordPress plugin.
A sophisticated cyber operation, attributed to a suspected Chinese-speaking threat actor, has successfully breached two Philippine organizations, including a nuclear research body and a marine engineering company serving the Philippine Navy. The attackers leveraged known vulnerabilities in internet-facing systems to steal a significant amount of sensitive data, highlighting the persistent risks associated with unpatched software.
The intrusion came to light after security researchers discovered an openly accessible server containing attack tools, exfiltration logs, and the stolen files themselves. The recovered data included critical research records related to nuclear reactors, personnel information, planning documents, encrypted credential stores, and a complete archive of the naval contractor's WordPress site. Hunt.io, which identified the exposed server on August 13, traced scripts on the server to attacks against these two organizations.
The primary vector for the breach into the nuclear agency's self-hosted ownCloud instance was CVE-2023-49105, an authentication bypass vulnerability. This flaw allowed attackers to create authenticated WebDAV requests without a password on affected installations lacking a configured signing key. The threat actor employed five custom Python scripts to systematically download files, using measured pauses between transfers to evade detection by routine monitoring systems. The exfiltrated data encompassed databases for reactor core components, fuel inventory, radiation safety documents, incident reports, staff resumes, travel records, and financial disclosures.
Further complicating the breach, the attackers also exfiltrated sensitive credential-related data, including a KeePass database, AxCrypt-encrypted files, and a PDF containing a BitLocker recovery key. These items could potentially facilitate future access attempts. Notably, the recovered stolen files were sorted into folders labeled in simplified Chinese, with categories such as finance, radiation safety, nuclear material accounts, and IT planning, further supporting the attribution to a Chinese-speaking operator.
The second organization, a marine engineering firm supporting the Philippine Navy, was compromised through CVE-2024-28000, a critical vulnerability in the LiteSpeed Cache WordPress plugin. This flaw enabled the attackers to create a new administrator account via the WordPress REST API after deriving the plugin's security hash. Logs indicated the exploit process took nearly three hours to successfully create the account. The attackers also attempted brute-force password guessing against the admin account via the site's XML-RPC interface.
This WordPress compromise resulted in the staging of three archives totaling 195 MB, containing the full WordPress installation, a database dump, and the media library. Such a comprehensive data dump can expose sensitive information like password hashes and plugin configurations, while the rogue administrator account provides a persistent backdoor. Separately, researchers noted an active EtherHiding-style compromise on the same WordPress site, though it was not directly linked to this specific operator's activities.
To mitigate these risks, organizations using ownCloud are urged to upgrade to version 10.13.3 or later and apply vendor patches, ensuring a strong signing key is configured. WordPress administrators should update the LiteSpeed Cache plugin to version 6.4 or higher, disable or restrict XML-RPC if unnecessary, enforce strong, unique passwords with multi-factor authentication, and regularly review administrator accounts. Monitoring for unusual WebDAV PROPFIND requests across multiple accounts is also recommended, as this activity pattern is associated with ongoing ownCloud attack campaigns.
This incident underscores the critical importance of maintaining up-to-date security measures for all internet-facing systems. The exploitation of well-known vulnerabilities in widely used platforms like ownCloud and WordPress continues to pose a significant threat, particularly to organizations handling data with national security implications. The scale of data exfiltrated and the nature of the targeted information highlight the evolving tactics of state-sponsored or state-aligned threat actors.