Hackers Exploit ownCloud and WordPress Flaws to Steal Philippine Nuclear and Naval Data

A suspected Chinese-speaking operator exploited known ownCloud and WordPress weaknesses to collect sensitive information from a Philippine nuclear research body and a marine engineering company that serves the Philippine Navy.

The intrusion shows how unpatched internet-facing systems can expose data with national-security value. The activity came to light after investigators found an openly accessible server containing attack tools, transfer logs, and stolen files.

The collection reportedly included reactor-related records, staff data, planning documents, encrypted credential stores, and a full archive of a naval contractor’s WordPress site.

Hunt.io identified the exposed server on August 13 and traced scripts on it to attacks against the two Philippine organizations.

Hunt.io said in a report shared with Cyber Security News (CSN) that the evidence points to a Chinese-speaking operator, although it did not attribute the campaign to a named group.

The apparent scale is concerning. A recovered inventory referred to roughly 9 GB of data taken from the nuclear agency, while researchers could directly recover 176 files, about 372 MB, in five staging folders. The difference suggests the accessible server showed only part of the collection effort.

Hackers Exploit ownCloud and WordPress Flaws

The nuclear agency’s self-hosted ownCloud service was accessed through CVE-2023-49105, an authentication bypass in the platform’s pre-signed link feature.

On affected installations with no configured signing key, attackers can create accepted WebDAV requests for known usernames without providing a password.

Five custom Python scripts used that weakness to download files account by account. They also used WebDAV directory requests to discover folders, then inserted short random pauses between downloads.

That measured approach reduced the chance that a large, rapid transfer would immediately stand out in routine monitoring.

The retrieved material included research-reactor core component databases, fuel inventory information, radiation-safety documents, incident records, staff resumes, travel records, and financial disclosures.

Investigators also found a KeePass database, AxCrypt-encrypted files, and a PDF containing a BitLocker recovery key, data that could assist later access attempts.

The operator sorted stolen files into folders labelled in simplified Chinese, including categories for finance, radiation safety, nuclear material accounts, and IT planning.

Similar reporting on ownCloud exploitation risks has shown why exposed collaboration systems demand fast patching and careful credential hygiene.

WordPress breach broadens access

The second intrusion affected a Philippine marine engineering and shipbuilding company linked to naval services.

Attackers used CVE-2024-28000 in the LiteSpeed Cache plugin, a flaw affecting versions before 6.4, to create a new administrator account through the WordPress REST API after deriving the plugin’s security hash.

Logs showed the exploit process ran for nearly three hours and 45 minutes before it found a working value and created the account.

The attackers also targeted the site’s XML-RPC interface with password guesses against the admin account, recording a successful credential pair in a separate output file.

They staged three archives totaling 195 MB: the full WordPress installation, its database dump, and the media library.

Such a haul can expose password hashes, plugin settings, and site secrets, while a rogue administrator account gives an intruder a straightforward way to return. Readers can compare the danger with rogue WordPress admin accounts created in other plugin attacks.

Researchers separately found an active EtherHiding-style compromise on the same WordPress site, but said the evidence did not connect it to this operator.

It used a fake verification page to deliver malware and a service worker for persistence, underscoring how a compromised site can host more than one threat. Recent coverage of WordPress sites used as C2 illustrates that broader risk.

Organizations using ownCloud should upgrade to version 10.13.3 or later, apply the vendor patch, and set a strong signing key.

WordPress operators should update LiteSpeed Cache to 6.4 or later, disable or restrict XML-RPC when it is unnecessary, use unique passwords and multi-factor authentication, and review administrator accounts.

Teams should also watch for unusual WebDAV PROPFIND requests across multiple accounts, an activity pattern relevant to ongoing ownCloud attack campaigns.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Server	31.58.209[.]241:8000	Open directory used to stage tools and stolen data
Network endpoint	31.58.209[.]241:8090	Endpoint from which the stage-two payload was retrieved
Filename	multi_backupd	Stage-one ELF loader found in the exposed directory
SHA-256	7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82	Hash of multi_backupd
Filename	stage2_payload.bin	Mettle stage-two payload retrieved by the loader
SHA-256	10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1	Hash of stage2_payload.bin
Ethereum smart contract	0x58460d0b3d4d6b03761c89120393c0c676676496	Artifact used by the NoChain EtherHiding-style loader
Delivery URL	fine-work-team[.]com/6272	Fake verification page delivering a VBS dropper
Delivery URL	timelevel12[.]com/big	Fake verification page delivering a VBS dropper
Telemetry endpoint	snake.zooparkko[.]com/collect	Endpoint used to receive visitor fingerprinting data

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC