ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

Summary

A Chinese-speaking threat actor has exploited a critical vulnerability in ownCloud (CVE-2023-49105) to steal sensitive nuclear records from a Philippine research body. The vulnerability, a WebDAV API authentication bypass, allowed the attacker to access files without authentication. The U.S. CISA has added this flaw to its Known Exploited Vulnerabilities catalog.

Full text

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body Ravie LakshmananAug 28, 2026Vulnerability / Cyber Espionage The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of WebDAV API authentication bypass that could allow an attacker to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured, which is the default configuration. Disclosed by ownCloud in November 2023, the issue impacts "core" versions from 10.6.0 through 10.13.0. It was fixed in version 10.13.1. CISA's addition of the flaw to the KEV catalog comes a couple of days after Hunt.io said it identified an open directory on the host "31.58.209[.]241," which staged custom Python scripts, open-source offensive security tooling such as Sliver, Metasploit, and Mettle, and exfiltrated data from two Philippine organizations, including a nuclear research body and a marine engineering and shipbuilding company that provides services to the Philippine Navy. "The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV," Hunt.io said. A separate intrusion is said to have exploited a WordPress site managed by the marine engineering and shipbuilding company. The threat intelligence firm attributed the attacks to a Chinese speaker due to the presence of simplified Chinese in source code comments, docstrings, log output, and folders used to sort stolen data. Five custom Python scripts present in the exposed directory have been found to implement an exploit for CVE-2023-49105, allowing an attacker who is in possession of valid usernames on an ownCloud instance to obtain unauthorized access without having to supply the credentials themselves. "An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as an authentication action by that user, without ever supplying credentials," Hunt.io said. Of the five scripts, four target a single account each, while the fifth script includes steps to enumerate the WebDAV directory and log every download attempt. In all, the threat actor is estimated to have downloaded 176 files totaling about 372 MB from the nuclear research entity and stored them across five staging directories. This includes nuclear-material account records, draft strategic plans covering 2023 through 2028, research reactor core components, historical fuel inventories, and presentation material, employee personal information, a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database, and credentials stores, such as BitLocker keys, a KeePass database, and AxCrypt-encrypted files. In tandem, the threat actor has also exploited a critical flaw in the LiteSpeed Cache plugin for WordPress (CVE-2024-28000, CVSS score: 9.8) to obtain elevated access to the WordPress site operated by another Philippines company. Separately, a Python script ("brute_xmlrpc.py") identified in the open directory targets the same site with an XML-RPC brute-force attack to guess account credentials, thereby giving the attackers a pathway independent of CVE-2024-28000. Further analysis of the WordPress source code has unearthed an active, possibly unrelated compromise that leverages EtherHiding to extract HTML content from an Ethereum smart contract and ultimately serve a Google verification page that's common in ClickFix-style attacks. The lure, for its part, launches "pcalua.exe" to invoke "mshta.exe" and download a Visual Basic Script (VBScript) dropper. "The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations," Hunt.io said. "The marine engineering firm's ties to the Navy align with interests tied to current South China Sea tensions. The specific material sought out and exfiltrated from the nuclear agency are a separate but complementary priority." In light of active exploitation of CVE-2023-49105, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by August 30, 2026. On Thursday, CISA also added two other flaws – each impacting Linux Kernel (CVE-2026-53362) and Artifactory (CVE-2026-66384) – to the KEV catalog after OpenAI revealed that its artificial intelligence (AI) agents exploited both of them to target its own internal infrastructure last month. "These activities were not part of, and did not contribute to, the chain of events that led to the Hugging Face compromise," OpenAI said in a technical explainer released this week. Federal agencies have time till August 30, 2026, to patch the Linux Kernel vulnerability and till September 10, 2026, to plug the Artifactory bug. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  cyber espionage, data breach, Vulnerability, Web Security ⚡ Top Stories This Week Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE Attackers Exploit SharePoint Authentication Bypass After Public PoC Release Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access ⭐ Featured Resources See How Keeper Secrets Manager Removes Hard-Coded Credentials Download the CISO's Guide to Smarter AI Security Investment Phishing Is Costing Security Teams More Than Ever — Read the New Report Build AI Agents and Automations Without Losing Security Control

Indicators of Compromise

• cve — CVE-2023-49105
• ip — 31.58.209.241
• cve — CVE-2024-28000

Entities