SecurityIndependently confirmed3 publishers2 min readPublished Updated
Suspected Chinese-speaking operator drained a Philippine nuclear agency via a 2023 ownCloud bypass
Hunt.io only found the intrusion because the operator left his staging directory browsable on port 8000 in Amsterdam. The scripts inside needed no passwords, just valid usernames and an ownCloud install nobody had updated.
The Watch · Security desk
What happened
- Hunt.io identified an open directory on host 31.58.209[.]241 on 13 August 2026 staging custom Python scripts, per-file transfer logs, offensive tooling and data taken from two Philippine organisations.
- The likely entry point was the nuclear research body's internet-facing ownCloud service, exploited through CVE-2023-49105, an authentication bypass affecting versions before 10.13.1.
- A separate intrusion exploited a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.
- The staging host sat in Amsterdam and ran no hidden service: a Python SimpleHTTP listing on port 8000, plus SSH and a self-hosted ownCloud login page, all reachable.
- Hunt.io reported to CERT-PH under TLP:AMBER and held publication until 25 August 2026 so the national response team could notify the affected organisations.
Why it matters
- capability Because the request is accepted as the named user with no credential presented, password rotation and MFA at the nuclear body buy nothing against this path. The version bump is the control that closes it.
- exposure Whoever holds the authorised-user lists and radiation-safety records can now build credible approaches to named reactor staff without touching the network again.
- constraint The recovered set cannot define scope. Responders have to reconstruct the loss from victim-side WebDAV logs, and retention on those is usually shorter than the intrusion.
- precedent This case reached a national CERT because the operator left his working directory browsable. Organisations with the same unpatched edge services and a tidier adversary get no notification at all.
The bypass works because the signing routine ran regardless. In ownCloud builds before 10.13.1, pre-signed URLs are generated with a signing key, and where no key was configured, the default state on new installs, the routine still executed using an empty secret [3]. An attacker who knows a valid username can then construct signed WebDAV requests that the server accepts as authenticated action by that user, without ever supplying credentials [4]. Hunt.io recovered five Python scripts implementing exactly that technique: four hardcoded to one account each, and a fifth that enumerated directories and logged every attempted download [20]. Random delays were built in to keep collection under volume-based alerting [21].
Then the arithmetic. The operator's own CSV references roughly 9 GB taken from the nuclear agency, most of it absent from the directory as captured [16]. What was actually sitting there was 176 files, about 372 MB [15]. That is near 4 percent of what the CSV describes [22]. The wider directory ran to 1,310 files and 1.17 GB [6], which leaves roughly 800 MB of tooling, scripts and logs [24], among them Sliver, Metasploit and Mettle [6].
The recovered fraction alone covers reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists [10], plus strategic plans, IT documentation, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials [12]. A KeePass database was in the haul [13]. The CSV also logs a compromised project management application, which points to a third victim nobody has named [17].
On attribution, keep the two registers apart. Documented: scripts, logs and folder names consistently in Simplified Chinese, with labels for nuclear, radiation-safety, finance and IT files [7]. Inferred: Hunt.io says this suggests a Chinese-speaking operator and states plainly that it does not prove links to a specific government or threat group [8]. The surrounding context, sustained South China Sea tension and continuing reports of suspected Chinese activity against Philippine government, defence and critical-infrastructure targets, is public and is not evidence of tasking [19].
The flaw carries a 2023 identifier [2] and the staging host was live in August 2026 [9], so call it three years of a patched authentication bypass still serving files off an internet-facing service [23]. The chain used well-known vulnerabilities in internet-facing ownCloud and WordPress [1] and open-source offensive tooling [6]. Edge inventory and version discipline were the control. They still are.
What to watch
- Whether CERT-PH or the nuclear research body publishes a loss figure that reconciles with the 9 GB in the operator's CSV.
- Whether the compromised project management application implied by the CSV is identified as a third victim.
- Whether the same five Python scripts appear against other ownCloud instances, which would move this from one operator's directory to a campaign.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption
- Insufficient
- Hype gap+8
- Incentives38
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 33%
- Operator
- Operator 57%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a marine engineering company that supports the Philippine Navy, using well-known vulnerabilities in internet-facing ownCloud and WordPress systems.
ReportedSupportedSource: Hunt.io, via securityaffairs.com3 sources— create a free account to open themView cited source - [2]
The main entry point was likely the nuclear research body's internet-facing ownCloud service, compromised by exploiting CVE-2023-49105, an authentication-bypass flaw in ownCloud versions before 10.13.1.
- [3]
In vulnerable instances where no signing key was configured, a default state on new installs, the signing routine still executed using an empty secret, so pre-signed URLs allowed unauthenticated retrieval of files over WebDAV.
- [4]
An attacker who knows a valid username on the instance could construct signed WebDAV requests that the server accepts as an authenticated action by that user, without supplying credentials.
- [5]
A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.
- [6]
The open directory contained 1,310 files in 86 folders totalling 1.17 GB, including scripts, stolen data and tools such as Sliver, Metasploit and Mettle.
- [7]
Scripts, logs and folders consistently used Simplified Chinese, including labels for nuclear, radiation-safety, finance and IT files.
- [8]
Hunt.io says the Simplified Chinese usage suggests a Chinese-speaking operator but does not prove links to a specific government or threat group.
- [9]
On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241 that staged custom Python scripts, per-file transfer logs, open-source offensive security tooling and exfiltrated data from two Philippine organisations.
- [10]
The stolen data included nuclear reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists.
- [11]
The activity was uncovered after Hunt.io found the exposed server in Amsterdam containing attack scripts, logs, offensive tooling and data taken from the two organisations.
- [12]
The stolen data also included strategic plans, IT documents, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials.
- [13]
The material also included a KeePass database.
- [14]
The staging server was not a hidden service: it exposed a Python SimpleHTTP directory on port 8000, along with SSH, a self-hosted ownCloud login page and other services.
- [15]
The exposed server held 176 files of stolen data, about 372 MB in total.
- [16]
A CSV created by the attacker referenced roughly 9 GB of material stolen from the nuclear agency, most of it absent from the current directory contents.
- [17]
The recovered CSV also references a compromise of a project management application, indicating a possible third victim.
- [18]
Hunt.io disclosed the findings to CERT-PH under the TLP:AMBER sharing standard and delayed publication until 25 August 2026 so the national response team could notify the affected organisations.
- [19]
The incident arrives amid sustained tensions in the South China Sea and continuing reports of suspected Chinese cyber activity against Philippine government, defence and critical-infrastructure targets.
- [20]
Hunt.io saved five custom Python scripts implementing the technique: four target a single account each, and the fifth adds directory enumeration and logging of every attempted download.
- [21]
The attacker used random delays to make data collection less noticeable and to avoid volume-based alerts.
- [22]
The 372 MB of stolen data recovered from the open directory is roughly 4 percent of the 9 GB the attacker's CSV describes.
- [23]
About three years separate the 2023 identifier year of CVE-2023-49105 and the August 2026 discovery of the staging server still exfiltrating through it.
- [24]
Tooling, scripts and logs account for roughly 800 MB of the 1.17 GB directory, once the 372 MB of stolen data is subtracted.
Sources
3 independent publishers whose own reporting we read for this story.
- Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities
hunt.io
1 article · August 30, 2026
- scworld.comSuspected Chinese actor targets Philippine nuclear and naval entities using known vulnerabilities
1 article · August 31, 2026
- securityaffairs.comPhilippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
1 article · August 29, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Threat Intelligence and Incident ResponseFollow
- Known Vulnerability ExploitationFollow
- South China Sea disputesFollow
- Cyber EspionageFollow