Chinese-Speaking Hackers Exploit ownCloud and WordPress Flaws to Target Philippine Nuclear and Naval Entities A suspected Chinese-speaking threat actor exploited unpatched vulnerabilities in ownCloud and WordPress to steal sensitive data from a Philippine nuclear research agency and a marine engineering firm linked to the Philippine Navy. The campaign, uncovered by Hunt.io on August 13, highlights the risks of exposed internet-facing systems in organizations handling national-security data. ### Attack Details The intrusions leveraged two critical flaws: 1. ownCloud (CVE-2023-49105) – An authentication bypass in the platform’s pre-signed link feature allowed attackers to access files via WebDAV requests without credentials. The nuclear agency’s self-hosted ownCloud instance was compromised using five custom Python scripts, which systematically downloaded files while evading detection with randomized delays. - Stolen data included: - Reactor core component databases - Fuel inventory and radiation-safety records - Staff resumes, travel logs, and financial disclosures - Encrypted credential stores (KeePass, AxCrypt) and a BitLocker recovery key - Files were organized in simplified Chinese-labeled folders, suggesting the operator’s linguistic background. 2. WordPress (CVE-2024-28000) – The marine engineering firm’s site was breached via a flaw in the LiteSpeed Cache plugin (versions <6.4), enabling attackers to create a rogue administrator account through the REST API. The exploit ran for nearly 4 hours before succeeding. - Stolen data included: - Full WordPress installation (195 MB) - Database dump and media library - Successful admin credentials (obtained via XML-RPC brute-forcing) - The site was also found hosting an unrelated EtherHiding-style malware (fake verification pages delivering VBS droppers), though no direct link to this campaign was established. ### Scope and Impact - Nuclear agency: ~9 GB of data was exfiltrated, though only 372 MB (176 files) were recovered from the exposed staging server. - Marine engineering firm: Attackers archived the entire WordPress site, including password hashes, plugin settings, and site secrets, granting persistent access. - Attribution: Hunt.io identified Chinese-language artifacts but did not attribute the activity to a known group. ### Technical Indicators The exposed server (31.58.209[.]241:8000) contained attack tools, transfer logs, and stolen files. Additional IoCs include: - Stage-one ELF loader: `multi_backupd` (SHA-256: `7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82`) - Stage-two payload: `stage2_payload.bin` (SHA-256: `10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1`) - EtherHiding artifacts: Fake verification domains (`fine-work-team[.]com`, `timelevel12[.]com`) and an Ethereum smart contract (`0x58460d0b3d4d6b03761c89120393c0c676676496`). The incident underscores the need for timely patching, credential hygiene, and monitoring of WebDAV and REST API activity in critical infrastructure.