The bypass works because the signing routine ran regardless. In ownCloud builds before 10.13.1, pre-signed URLs are generated with a signing key, and where no key was configured, the default state on new installs, the routine still executed using an empty secret [5]. An attacker who knows a valid username can then construct signed WebDAV requests that the server accepts as authenticated action by that user, without ever supplying credentials [6]. Hunt.io recovered five Python scripts implementing exactly that technique: four hardcoded to one account each, and a fifth that enumerated directories and logged every attempted download [7]. Random delays were built in to keep collection under volume-based alerting [8].
Then the arithmetic. The operator's own CSV references roughly 9 GB taken from the nuclear agency, most of it absent from the directory as captured [13]. What was actually sitting there was 176 files, about 372 MB [12]. That is near 4 percent of what the CSV describes [1]. The wider directory ran to 1,310 files and 1.17 GB [11], which leaves roughly 800 MB of tooling, scripts and logs [2], among them Sliver, Metasploit and Mettle [11].
The recovered fraction alone covers reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists [17], plus strategic plans, IT documentation, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials [18]. A KeePass database was in the haul [19]. The CSV also logs a compromised project management application, which points to a third victim nobody has named [14].
On attribution, keep the two registers apart. Documented: scripts, logs and folder names consistently in Simplified Chinese, with labels for nuclear, radiation-safety, finance and IT files [15]. Inferred: Hunt.io says this suggests a Chinese-speaking operator and states plainly that it does not prove links to a specific government or threat group [16]. The surrounding context, sustained South China Sea tension and continuing reports of suspected Chinese activity against Philippine government, defence and critical-infrastructure targets, is public and is not evidence of tasking [21].
The flaw carries a 2023 identifier [4] and the staging host was live in August 2026 [2], so call it three years of a patched authentication bypass still serving files off an internet-facing service [3]. The chain used well-known vulnerabilities in internet-facing ownCloud and WordPress [1] and open-source offensive tooling [11]. Edge inventory and version discipline were the control. They still are.
