The mechanism is a signature that validates against nothing. ownCloud's WebDAV API accepted pre-signed URLs, and where no signing key is configured, the signature is computed over an empty secret, so a request forged by anyone is accepted as an authentication action by whichever user it names [2][6]. The prerequisite is knowledge of a valid username, and the vulnerable state is the default one [2]. Hunt.io found five Python scripts built on that primitive: four hardcoded to a single account each, and a fifth that walks the WebDAV directory and logs every download attempt [8][9]. Enumeration with logging is inventory work rather than spray.
Hunt.io puts the haul at 176 files, about 372 MB, spread across five staging directories [10]. One item accounts for 192 MB of it, a SQL dump of a ZKTeco BioTime attendance and personnel database [12]. That makes roughly 52 percent of the volume one HR system, and leaves the other 175 files averaging about a megabyte each [1][2], which reads as documents rather than archives. The documents are the point: nuclear-material account records, draft strategic plans covering 2023 through 2028, research reactor core components, historical fuel inventories [11]. The same directories held BitLocker keys, a KeePass database and AxCrypt-encrypted files [13], so the sync server was also holding keys to material it did not store itself.
ownCloud fixed this in core 10.13.1 in November 2023 [3]. CISA's deadline for federal civilian agencies is August 30, 2026 [4], which is 33 months after the fix shipped [3]. The bug itself is unchanged by the listing, but a 2023 backlog line is now a dated obligation, and it applies to self-hosted file-sync servers, which are the ones least likely to have a named owner.
The second Philippine victim, a marine engineering and shipbuilding firm, was reached through the LiteSpeed Cache plugin flaw CVE-2024-28000 [14], with a separate script, brute_xmlrpc.py, brute-forcing XML-RPC credentials on the same site as a path independent of that CVE [15]. Patching the plugin would have closed one of the two. Hunt.io also reports an active and possibly unrelated compromise on the same WordPress code, using EtherHiding to pull HTML from an Ethereum smart contract and serve a ClickFix-style Google verification page, with pcalua.exe invoking mshta.exe to fetch a VBScript dropper [16].
The tooling and the language artifacts are what is public; everything built on top of that, the attribution and the motive, is inference. Hunt.io stops at "Chinese speaker" and explicitly leaves open whether the operator is state-affiliated, contracted, or independent [17]. The targeting read is Hunt.io's as well: the shipbuilder's Navy ties align with South China Sea collection interests, and the nuclear material is treated as a complementary priority [17].
