Full research report

ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

A Chinese-speaking operator exploited CVE-2023-49105 — an ownCloud WebDAV authentication bypass disclosed in November 2023 — nearly three years after its publication to exfiltrate reactor records, fuel inventory data, personnel files, and credential stores from a Philippine government nuclear research body. The intrusion was discovered not through victim reporting but through Hunt.io's passive identification of an exposed staging server in Amsterdam that housed custom exploitation scripts, Sliver C2 infrastructure, and the stolen data organised into simplified-Chinese-labelled directories. A parallel campaign against a Philippine Navy shipbuilding contractor leveraged CVE-2024-28000 in the LiteSpeed Cache WordPress plugin for unauthenticated administrator account creation, indicating deliberate sector targeting of Philippine defence and nuclear infrastructure rather than opportunistic exploitation. The operator's use of randomised request timing in custom scripts and coordinated responsible disclosure to CERT-PH before publication suggest a disciplined collection operation; however, the absence of named-group attribution and the possibility of linguistic false-flagging remain material uncertainties.

What happened

A suspected Chinese-speaking operator exploited CVE-2023-49105, a critical authentication bypass in ownCloud's WebDAV API disclosed in November 2023, to exfiltrate sensitive records from a Philippine nuclear research body. Hunt.io identified the intrusion on 13 August 2026 when it discovered an exposed staging directory on an Amsterdam-based server containing custom exploit scripts, open-source offensive tooling, and stolen files. A parallel intrusion against a Philippine Navy marine engineering contractor exploited CVE-2024-28000, an unauthenticated privilege-escalation flaw in the LiteSpeed Cache WordPress plugin. CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalogue on 27 August 2026, with a remediation deadline of 30 August 2026.

Affected scope

ownCloud Server versions 10.6.0 through 10.13.0 where no signing key is configured for user accounts (the default state); confirmed victims are a Philippine nuclear research body and a Philippine Navy contractor running an unpatched WordPress LiteSpeed Cache installation; a possible third Philippine science or research organisation may have been affected based on data present on the staging server.

Technical assessment

CVE-2023-49105 arises from the ownCloud WebDAV API accepting pre-signed URL requests constructed with an empty signing secret when the targeted account has no signing key configured. An adversary with knowledge of a valid username can issue WebDAV file operations that the server treats as authenticated without credential exchange. The threat actor deployed five custom Python scripts implementing this technique with deliberate randomised timing delays between requests to reduce detection likelihood. Exfiltrated data was sorted into folders labelled in simplified Chinese. The secondary intrusion used CVE-2024-28000 to derive the LiteSpeed Cache plugin's security hash via the WordPress REST API, enabling unauthenticated administrator account creation without requiring credentials.

Recommended defensive actions

  1. Upgrade ownCloud Server to version 10.13.1 or later immediately; CISA has set a federal remediation deadline of 30 August 2026
  2. Configure a strong, non-empty signing key for every ownCloud user account, as the absence of a signing key is the directly exploitable condition
  3. Audit ownCloud WebDAV access logs for PROPFIND enumeration patterns, bulk file downloads from a single source IP, and file operations lacking credential-exchange evidence
  4. Update the LiteSpeed Cache WordPress plugin to version 6.4 or later to remediate CVE-2024-28000 and audit administrator accounts for unauthorised additions
  5. Block or restrict /xmlrpc.php on all WordPress installations and investigate any external XML-RPC requests in server logs
  6. Investigate and rotate credentials, encryption keys, BitLocker recovery keys, and KeePass or AxCrypt material that may have been stored within affected ownCloud instances
  7. Hunt for the staging server indicator 31.58.209[.]241 across network telemetry and block at perimeter if found

Uncertainties and evidence gaps

  • The threat actor has not been attributed to a named group; simplified Chinese linguistic markers in tooling constitute supporting evidence but could reflect deliberate false-flag tradecraft
  • Hunt.io's staging-server CSV references approximately 9 GB of total exfiltrated data, whereas only approximately 372 MB was confirmed in recovered staging directories — the remainder is unaccounted for
  • The specific identity of the Philippine nuclear research body has not been publicly confirmed in reviewed reporting
  • Whether the possible third organisation whose data appeared on the staging server was directly compromised or whether that data arrived via a separate, unidentified route is not established

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to a publicly reachable ownCloud instance; only a valid username on the target instance is required — no password or session token is needed
ComponentownCloud core WebDAV API pre-signed URL handler, versions 10.6.0 through 10.13.0
MechanismThe server accepts WebDAV requests signed with an empty secret when the target account has no signing key configured, bypassing the authentication check that pre-signed URL validation is intended to enforce
ImpactUnauthenticated read, modification, and deletion of any file belonging to the identified user account, enabling bulk data exfiltration without credential theft
DetectionPROPFIND enumeration of WebDAV directory trees; bulk sequential file downloads from a single source IP without preceding credential negotiation; absence of authentication headers in WebDAV access logs for file operations
MitigationUpgrade to ownCloud core 10.13.1 or later and configure a non-empty signing key for all user accounts; as an interim control, restrict WebDAV access to trusted network ranges
Exploitation status

Confirmed active exploitation of CVE-2023-49105 against a Philippine nuclear research body; CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 27 August 2026 following Hunt.io's disclosure of a confirmed intrusion with evidence of targeted data exfiltration.

Research process

Investigation began with the CISA KEV addition of CVE-2023-49105 on 27 August 2026 and source-material claims of a Philippine nuclear espionage incident. Research focused on locating and verifying Hunt.io's original disclosure, the CISA advisory via a secondary source (the CISA.gov alert URL returned HTTP 403), the ownCloud vendor advisory, and independent corroborating outlets. All verified sources consistently support a high-confidence assessment of confirmed targeted cyber-espionage by a suspected Chinese-speaking operator against Philippine government-linked defence and nuclear infrastructure.

  1. Is CVE-2023-49105 a real, documented vulnerability and what is its mechanism?
    Searched for CVE-2023-49105 ownCloud WebDAV authentication bypass

    CVE-2023-49105 is a CVSS 9.8 authentication bypass in ownCloud 10.6.0–10.13.0, disclosed November 2023; affects all installations where no signing key is configured

    why Establishes that the CVE cited in source material is real and correctly described before assessing exploitation claims

  2. What did Hunt.io actually report and does it support the claims in the untrusted article?
    Fetched Hunt.io primary research report
    hunt.io ↗

    Hunt.io confirmed discovery of an exposed staging server on 13 August 2026 containing five custom Python exploit scripts, open-source offensive tooling, and stolen data from a Philippine nuclear body and a Navy contractor; simplified Chinese markers present throughout custom tooling

    why This is the first-party intelligence source; its confirmation of specific artefacts and victim data elevates the story from claimed to evidenced

  3. Did CISA independently confirm exploitation by adding CVE-2023-49105 to the KEV catalogue?
    Searched for CISA KEV CVE-2023-49105 August 2026 known exploited

    Search results from CISA.gov and Security Affairs confirmed addition of CVE-2023-49105 to KEV on 27 August 2026 alongside CVE-2026-53362 and CVE-2026-66384, with a remediation deadline of 30 August 2026

    why A CISA KEV listing is an independent government confirmation of in-the-wild exploitation and materially corroborates Hunt.io's findings

  4. Does Security Affairs accurately represent the CISA KEV details?
    Fetched Security Affairs article on the KEV additions
    securityaffairs.com ↗

    Confirmed three CVEs added on 27 August 2026; CVE-2023-49105 deadline is 30 August 2026; description consistent with ownCloud advisory; the CISA.gov alert page itself returned HTTP 403

    why Verifies CISA KEV details via an accessible secondary source; confirms the direct CISA URL is inaccessible but the information is independently corroborated

  5. Does the ownCloud vendor advisory confirm affected versions and fix version?
    Fetched ownCloud security advisory for the WebDAV pre-signed URL bypass
    owncloud.com ↗

    Advisory confirmed: affected versions 10.6.0–10.13.0; disclosed 21 November 2023; CVSS 9.8; fix is to deny pre-signed URL access when no signing key is configured

    why Vendor confirmation of the vulnerability scope and patch version is required for accurate defensive guidance

  6. Does GreyNoise provide independent technical corroboration of the bypass mechanism?
    Fetched GreyNoise blog post on CVE-2023-49105
    greynoise.io ↗

    GreyNoise corroborated the authentication bypass mechanism and confirmed it affects all ownCloud installations in the affected range, not only Docker deployments; no exploitation was observed at publication in December 2023

    why Provides independent technical validation of the vulnerability description and contextualises the roughly 32-month gap between initial disclosure and confirmed exploitation

  7. Do independent outlets add detail on the secondary LiteSpeed Cache attack and further corroborate the incident?
    Fetched GBHackers and CyberSecurityNews articles on the Philippine incident
    cybersecuritynews.com ↗

    Both outlets independently corroborated the attack timeline, the LiteSpeed Cache CVE-2024-28000 exploitation technique (security hash derivation via REST API), and the data volumes stolen from each victim

    why Independent secondary corroboration from two separate outlets confirms the incident details are consistently reported across sources

Named in this story
ActorsSuspected Chinese-speaking threat actor (no named group attribution; medium-confidence targeted collection assessment)
MalwareSliver (open-source C2 framework)Mettle (Metasploit stager)multi_backupd (stage-1 loader; SHA-256: 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82)Custom Python ownCloud pre-signed URL exploitation scripts (5 variants)Custom Go LiteSpeed Cache exploit (CVE-2024-28000)
TargetsPhilippine nuclear research body (government-affiliated)Philippine marine engineering and shipbuilding company (Philippine Navy contractor)
Related CVEs CVE-2023-49105CVE-2024-28000

Research coverage

All 73 registered source leaves were evaluated for this run: 66 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 2 corroborating, 1 contextual and 0 PoC/exploit references). 61 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 73 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1685 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
The Hacker Newsnews ok13 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
NVDcve ok900 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok9 records Checked — no match The source completed, but none of its retained records matched this story.
CERT-EU Threat Intelligencenews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok687 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1012 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
SentinelLabsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos X-Opsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The DFIR Reportnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit 42news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
WeLiveSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Additional verified pages 6 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2023-49105 CISA KEV ownCloud ownCloud · added 2026-08-27 CISA catalog ↗
CVE-2023-49105 EPSS 11.1% 96th percentile exploitation probability
PoC & exploit code2
Hunt.io: Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator hunt.io ↗

Primary report; describes five custom Python scripts implementing the pre-signed URL bypass against a live ownCloud instance

GreyNoise: CVE-2023-49105 WebDAV API Authentication Bypass in ownCloud greynoise.io ↗

Technical write-up of the bypass mechanism; confirms the flaw affects all installations in the version range, not only Docker deployments

Vendor & gov advisories2
ownCloud Security Advisory: WebDAV API Authentication Bypass Using Pre-Signed URLs owncloud.com ↗

Vendor advisory disclosing CVE-2023-49105 on 21 November 2023; recommends denying pre-signed URL access when no signing key is configured

Security Affairs: CISA Adds ownCloud, Linux Kernel, and JFrog Artifactory Flaws to Known Exploited Vulnerabilities Catalogue securityaffairs.com ↗

Confirms CISA KEV addition of CVE-2023-49105 on 27 August 2026 with a remediation deadline of 30 August 2026

Analysis & research3
Hunt.io: Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator hunt.io ↗

Original threat-intelligence report identifying staging server, custom tooling, data categories exfiltrated, and attribution indicators

GBHackers: Hackers Exploit CVE-2023-49105 to Steal Nuclear Records From Philippine Research Agency gbhackers.com ↗

Independent secondary corroboration covering the ZKTeco BioTime SQL dump and the LiteSpeed Cache secondary attack chain

CyberSecurityNews: Hackers Exploit ownCloud and WordPress Flaws to Steal Philippine Nuclear and Naval Data cybersecuritynews.com ↗

Independent summary adding detail on the CVE-2024-28000 LiteSpeed Cache hash-derivation technique used against the naval contractor