Cyberattack on Philippine Nuclear and Navy: ownCloud and WordPress Used as Attack Vector

On 13 August 2026, Hunt.io researchers identified an unprotected server in Amsterdam (31.58.209[.]241) exposing a Python SimpleHTTP directory on port 8000. The directory contained 1,310 files in 86 folders, totalling 1.17 GB: custom scripts, transfer logs, open-source offensive tools such as Sliver, Metasploit, and Mettle, and data stolen from two Philippine organizations. The findings were shared with CERT-PH under TLP:AMBER, and publication was postponed to 25 August 2026 to give the national response team time to notify the victims.

An Amsterdam Server Exposes Scripts, Logs, and Loot

The open directory displayed folders and scripts with labels in Simplified Chinese related to nuclear materials, radiological safety, finance, and IT. This suggests a Chinese-speaking operator, but does not allow attribution to a specific government or group.

The attacker used random delays in data collection to keep volume low and evade traffic-based alerts. Only 176 files for about 372 MB were present on the server, but a CSV created by the attacker referenced around 9 GB of material stolen from the nuclear agency, most of it absent from the current directories. That gap indicates the server held only a fraction of the loot and that the operator's access was likely broader than what was recovered.

The Two Exploited Vulnerabilities

The primary entry point appears to have been the nuclear research agency's internet-exposed ownCloud service. CVE-2023-49105 (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) affects ownCloud Server versions before 10.13.1, starting from 10.6.0. The flaw allows anyone who knows a valid username to generate WebDAV requests that the server accepts as coming from that user, without requiring a password, when the victim has not configured a signing key for pre-signed URLs.

Hunt.io found five custom Python scripts implementing this technique: four targeted individual accounts, while one was able to enumerate directories and record every attempted download. The absence of a robust signing key makes unauthenticated file access trivial.

The same server also revealed the compromise of a Philippine naval engineering and shipbuilding company through CVE-2024-28000 (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-266) in the LiteSpeed Cache plugin for WordPress in versions before 6.4 (up to 6.3.0.1 according to the NVD description). This improper privilege assignment flaw allows an attacker to create an administrator account without authentication by exploiting a predictable security hash in the REST APIs. Hunt.io recovered exploit code, compiled tools, and logs showing the compromise with administrator privileges. In addition, the attacker used WordPress XML-RPC to test the admin account's password against the rockyou.txt wordlist and found valid credentials—a redundancy to maintain access even if one of the two vectors was closed.

The Loot: Reactors, Personnel, and Physical Access

Data exfiltrated from the nuclear agency includes reactor component databases, fuel inventories, radiological safety documents, incident logs, authorized user lists, strategic plans, IT documents, personnel files, CVs, passport and travel data, and financial statements of Philippine officials. The server also held a KeePass database, files encrypted with AxCrypt, and a BitLocker recovery key—artifacts that can turn data theft into credential theft and long-term intrusion.

A 192 MB SQL dump from a ZKTeco BioTime attendance and personnel system links people to ID badges, departments, and access logs, enabling the mapping of who works where and who holds sensitive access. A CSV also referenced the compromise of a project management application, pointing to a possible third victim.

CVE-2023-49105 Enters KEV: Deadline August 30

On 27 August 2026, CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities (KEV) catalog. U.S. federal agencies have until 30 August 2026 to apply vendor mitigations in line with BOD 26-04, or discontinue use of the product if fixes are not available. The move confirms that the flaw is actively exploited and not merely theoretical.

CVE-2024-28000 does not appear in the KEV catalog, despite evidence of its use in this attack. Over the last 90 days, for the same vendors—LiteSpeed Technologies and ownCloud—CVE-2026-54420 also entered the KEV on 15 June 2026, indicating a sequence of critical vulnerabilities in these companies' products under scrutiny.

What to Do: Patches, Configurations, and Indicators

For ownCloud installations, upgrading to version 10.13.3 or later resolves CVE-2023-49105. It is essential to configure a strong, non-empty signing key for pre-signed URLs. In WebDAV logs, look for suspicious PROPFIND enumeration requests, high download volumes across multiple accounts, or recurring requests from a single source with artificial intervals: low-and-slow collection is still collection.

For WordPress with LiteSpeed Cache, upgrade the plugin to version 6.4 or later. When not needed, XML-RPC should be removed or restricted. Administrator passwords must be unique and complex, and multi-factor authentication should be enabled.

An Unrelated Ethereum Injection

The compromised WordPress site also contained an active EtherHiding-style JavaScript injection. The code used an Ethereum smart contract to retrieve content, displayed a fake Google verification page, and directed visitors to a ClickFix infection. A service worker ensured persistence, and the payload collected fingerprinting data. Hunt.io identified 174 unique IP addresses with the same NoChain loaders and reference to the smart contract, but the evidence does not link this activity to the operator that targeted the nuclear and naval organizations. A compromised site can host multiple intrusions at the same time, managed by different actors.