Hunt.io traced malicious scripts on August 13 to an unprotected server containing 9 GB of exfiltrated data from a Philippine nuclear research institution and a naval contractor, according to a report shared with Cyber Security News. The breach exploited CVE-2023-49105 in ownCloud and CVE-2024-28000 in the LiteSpeed Cache WordPress plugin, with investigators recovering 176 files totaling 372 MB across five staging directories.
TL;DR: A suspected Chinese-speaking attacker exploited known vulnerabilities in ownCloud and WordPress systems to extract nuclear research records, naval contractor databases, and encrypted credential vaults from two Philippine entities, with the exposed server discovered August 13.
The exposed server contained attack tools, transfer logs, and stolen documents including reactor-related records, personnel data, strategic documents, encrypted credential vaults, and a complete WordPress site backup from the marine engineering firm. Evidence indicates a Chinese-speaking operator based on file organization using simplified Chinese labels, though investigators named no specific threat group.
The 9 GB total exfiltration volume far exceeds the 372 MB recovered sample, suggesting the exposed server represented only a staging point in a larger data collection operation. The nuclear agency and naval contractor breaches occurred through distinct vulnerabilities requiring different exploitation techniques.
ownCloud Authentication Bypass Extracts Nuclear Research Files
The nuclear agency's self-hosted ownCloud installation fell to CVE-2023-49105, an authentication bypass flaw in the platform's pre-signed link functionality. Installations lacking a configured signing key allow attackers to issue WebDAV requests for known usernames without passwords.
Five specialized Python scripts exploited this weakness to systematically download files for each compromised username. The scripts employed WebDAV directory requests to map accessible folders and incorporated random delays between downloads to evade detection during routine monitoring.
Recovered files included research-reactor core component databases, fuel inventories, radiation safety documents, incident records, employee resumes, travel itineraries, and financial disclosures. Investigators also found a KeePass database, AxCrypt-encrypted files, and a PDF containing a BitLocker recovery key—assets enabling potential future access attempts.
The attacker organized confiscated documents into directories labeled in simplified Chinese, including categories for financial records, radiation safety protocols, nuclear materials accounting, and IT planning. This methodical file management suggests operational discipline beyond typical opportunistic breaches.
Organizations managing WordPress development services for clients in sensitive sectors face similar risks when collaboration platforms remain unpatched. The ownCloud exploit required no plugin chain—just a misconfigured core installation exposed to the internet.
WordPress LiteSpeed Cache Flaw Grants Naval Contractor Access
The marine engineering firm's WordPress site, which provides services to the Philippine Navy, fell to CVE-2024-28000 affecting LiteSpeed Cache versions prior to 6.4. Attackers derived the plugin's security hash through the WordPress REST API, enabling creation of a new administrator account.
Server logs show the exploit ran for three hours and forty-five minutes before identifying a viable hash value to establish the rogue account. The perpetrators simultaneously attempted XML-RPC brute-force attacks against the admin account, successfully recording working credentials in an isolated output file.
Three archives totaling 195 MB captured the entire WordPress installation, database dump, and media library. This package exposes password hashes, plugin configuration settings, and confidential site data, while the administrator account provides persistent backdoor access.
Researchers also discovered an active EtherHiding-style compromise on the same WordPress site, though they found no direct connection to the primary attacker. This secondary compromise used a fraudulent verification page to upload malware with a service worker for persistence—demonstrating how a single compromised site can harbor multiple independent threats.
The pattern mirrors recent incidents where agencies discovered WordPress sites hijacked for cybercrime infrastructure, with multiple attacker groups targeting the same vulnerable installations through different entry vectors.
Agencies maintaining client sites should consider whether to hire WordPress developers with security specialization rather than relying on generalist staff to manage patching protocols across dozens of installations with varying plugin configurations.
Indicators Point to Systematic Campaign
The exposed server at 31.58.209[.]241:8000 contained not just stolen data but the complete toolchain used in both attacks. Python scripts for ownCloud exploitation included documentation comments in English, while file organization used simplified Chinese—suggesting either a multilingual operator or a team environment.
The methodical approach—random delays, organized staging directories, credential harvesting for future access—indicates operational security awareness rather than automated scanning. The attacker invested nearly four hours in hash derivation for the WordPress site alone, demonstrating patience uncommon in mass-exploitation campaigns.
Hunt.io's discovery of the unprotected server represents an intelligence windfall rare in breach investigations. Most attackers remove staging infrastructure immediately after exfiltration; this server remained accessible with logs intact.
Security teams should monitor for anomalous WebDAV PROPFIND requests across multiple accounts, as this activity pattern remains relevant to ongoing campaigns targeting ownCloud installations. Similar monitoring for REST API hash derivation attempts can flag LiteSpeed Cache exploitation attempts before administrator account creation succeeds.
The KeePass database and BitLocker recovery key found among stolen nuclear agency files suggest the initial breach may enable deeper network penetration beyond the ownCloud platform. Organizations confirming ownCloud compromise should assume lateral movement potential and audit all systems accessible from compromised accounts.
What Happens Next
Organizations running ownCloud must upgrade to version 10.13.3 or later and verify that signing keys are properly configured, eliminating the authentication bypass attack surface. WordPress administrators should update LiteSpeed Cache to version 6.4 minimum, disable XML-RPC functionality when not required, and audit administrator account lists for unauthorized entries created during the exploitation window.
Agencies managing client portfolios should treat this incident as a patching protocol stress test. The ownCloud vulnerability disclosed in November 2023; the LiteSpeed Cache flaw patched in May 2024. Both remained exploitable nine and three months post-disclosure respectively—a timeline that exposes gaps in systematic update procedures across client sites. Security guidance released after plugin exploits launched within hours of disclosure applies equally to older vulnerabilities that remain unpatched on legacy installations.
The Philippine breach demonstrates that national-security-adjacent organizations run the same vulnerable software as commercial agencies. White-label providers supporting government contractors or critical infrastructure clients should document patching SLAs explicitly, with escalation procedures for high-severity CVEs affecting platforms in scope.