Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities
Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities
Published on
Reported cyber intrusion activity by suspected Chinese actors against Philippine government, defense, and critical infrastructure organizations over the past several years has increased with ongoing tensions in the South China Sea. Microsoft's Digital Defense Report 2025 placed the Philippines 20th globally among countries most impacted by cyber activity in the first half of 2025, and noted Chinese state actors targeting the Philippines as part of broader Southeast Asia espionage against IT, government, and academic sectors
On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV. A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.
The operator is likely a Chinese speaker, due to the use of code comments, docstrings, log output, and folders used to sort stolen data containing simplified Chinese.
Key Findings
Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations.
A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim.
Five staging directories associated with the nuclear research entity hold 176 files totaling ~372 MB, sorted under Chinese-language subfolders for their content.
Retrieved material included nuclear-material account records, a research reactor core-component database, employee PII, and credentials stores: BitLocker keys, KeePass, and AxCrypt.
A complete WordPress site archive with core files, uploads, and a database dump were exfiltrated from the second marine engineering victim network.
A 192 MB SQL dump from a ZKTeco BioTime attendance and personnel database, recovered from the same server, referenced multiple related Philippine science and research organizations, indicating a possible focus on tracking individuals working for these institutions.
Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator.
What follows examines each of these findings in turn, beginning with the open directory itself.
The Open Directory
Hunt.io identified the open directory on August 13, 2026 at 31.58.209[.]241:8000, served via Python's built-in SimpleHTTP module. The server, located in Amsterdam, is registered to CGI Global Limited (AS56971).
Figure 01: Hunt.io IP intelligence data for 31.58.209[.]241 hosted on CGI Global Limited exposing ports 22, 8000, and 54329.| Port | Service | Context |
|---|---|---|
| 22 | SSH | OpenSSH 9.6p1 (Ubuntu) |
| 80 | HTTP | Self-hosted OwnCloud login page |
| 8000 | HTTP | The open directory itself (SimpleHTTP/Python) |
| 8080 | HTTP | BaseHTTP/0.6 Python/3.12.3, returns a plain "OK" response |
| 54329 | TCP | Accepts raw TCP connections but returns no data on interaction |
The server hosts an OwnCloud instance on port 80 which possibly serves as a local testing environment. This setup would allow the operator a controlled environment to test out the pre-signed URL technique before sending requests to the intended target.
Figure 02: Self-hosted OwnCloud instance on the attacker-controlled server.The directory contains 1,310 files totaling 1.17 GB across 86 subdirectories, with offensive tooling, exploit scripts, and stolen victim data separated into top-level folders. As of the publication of this research, the server remains accessible.
Offensive Tooling
Three open-source frameworks were also present on the host. None of the recovered logs or configuration tie any of them to the intrusion activity, but their presence alongside malicious code and stolen data suggests the operator retained the tools for testing or future use.
| Tool | Description |
|---|---|
| Sliver | Cross-platform C2 framework written in Go and maintained by Bishop Fox, used in both red-team engagements and adversary operations. |
| Metasploit | Open-source exploitation and post-exploitation framework maintained by Rapid7, providing exploit modules, payload generation, and handler infrastructure. |
| Mettle | Portable, cross-platform Meterpreter implementation designed for embedded and constrained environments, distributed alongside Metasploit. |
In addition to installing and configuring the above projects, the operator also created a stage-1 ELF loader named multi_backupd (SHA-256: 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82).On analysis, the loader connects over TCP to the same IP on port 8090 and pulls a Mettle stage-2 payload, which we retrieved (see IOCs).
Figure 03: Attack Capture file manager displaying the directory contents on 31.58.209[.]241:8000.The bulk of the recovered documents on the server are dedicated to exploiting and retrieving data from an ownCloud instance, which is examined in the next section.
ownCloud Compromise via CVE-2023-49105
ownCloud is an open-source file synchronization and collaboration platform commonly deployed by organizations as a self-hosted alternative to commercial cloud storage. The software's WebDAV interface exposes user files and folders supporting upload, download, and directory enumeration. An internet facing ownCloud deployment run by the nuclear agency, likely used as a shared document repository was the operator's point of access.
In November 2023, ownCloud disclosed CVE-2023-49105, a critical authentication bypass affecting the pre-signed URL mechanism in versions prior to 10.13.1. These URLs were intended to let the platform generate time-limited signed links to files, using a per-instance signing key.
In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.
A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging. Each share the same signing routine:
def compute_hash(url):
return hashlib.pbkdf2_hmac("sha512", url.encode(), b"", 10000, dklen=32) .hex()
def build_signed_url(method, username, url):
parsed = urllib.parse.urlparse(url)
qs = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True)
qs += [("OC-Credential", username), ("OC-Verb", method),
("OC-Expires","1000"), ("OC-Date", "")]
qs_str = urllib.parse.urlencode(qs)
p2 = urllib.parse.ParseResult(parsed.scheme, parsed.netloc, parsed.path, parsed.params, qs_str, parsed.fragment)
sig = compute_hash(urllib.parse.urlunparse(p2))
qs += [("OC-Signature", sig)] ...
CopyCode snippet displaying the shared signing routine targeting ownCloud instances.
The empty bytes literal (b"") passed as the PBKDF2 salt is the signing secret. Properly configured instances would contain a long random string set at install. The scripts assume it is empty, which is the default state CVE-2023-49105 exposes. Each script sets OC-Credential to the account it wants to impersonate and issues GET requests against
/remote.php/dav/files/<account>/<path>, receiving files as that user with no credentials passed.
Beyond exploitation, the operator went to lengths to ensure sustained collection that would not draw the eyes of defenders. The per-account script inserts time.sleep(random.uniform(3, 6)) between requests, while the fifth tightens to a 1.5 to 3.5 second window. Random gaps are meant to evade signatures on outbound traffic and avoid any volumetric detection measures that may be in place.
Docstrings within the code are written in Simplified Chinese, pairing the target account with the area of interest: "低速下载 ... 核材料文档" (low-speed download of nuclear material documents), "低速下载 ... 辐射安全关键文件" (low-speed download of radiation safety key files), and "低速下载 ... IT规划" (low-speed download of IT planning files). Retrieved files are sorted into Chinese-named subject folders inside each per-account output folder, including 财务 (Finance), 辐射安全 (Radiation Safety), 核材料账目 (Nuclear Material Accounts), and IT规划 (IT Planning). The heavy use of Chinese in the docstrings, code comments, and output folders strongly suggests the operator is a native speaker, or very comfortable with the language.
Figure 04: Snippet of oc_hm_dl.py showing the retrieval of radiation safety-related files.The fifth script, titled oc_vps_download.py enumerates the WebDAV directory by issuing PROPFIND requests with Depth: 1, and parsing the returned response blocks. This provides the operator with the ability to recursively search folders not already enumerated. After processing a hardcoded list of individual files the code drops into four selected folders, including two containing BitLocker key material and one containing foreign travel records. Every download attempt writes to a local log at /root/oc_download.log.
These same log files offered an insight into what data the operator was most interested in.
Targeted Material and Personnel Intelligence
After running all five scripts, separate folders were created, holding a combined 176 files totaling 372 MB. oc_vps.out shows the successful download of each file, and matches those present on the directory and its subfolders.
Figure 05: Redacted output from oc_vps.out showing the retrieved files from the ownCloud instance.The stolen documents are broken up across four categories, split in no particular order across the five folders.
Nuclear operations and safety. The oc_km_data folder (13 items, 8.48 MB) holds documents from a reactor operations account: two versions of a database of research reactor core components, historical fuel inventories, and presentation material. oc_hm_data (6 items, ~2 MB) contains documentation on radiation safety, incident reporting, a draft safety manual, and an authorized user list. Together this material provides a technical picture of the facility: reactor configuration, movement histories, and the individuals authorized to interact with that equipment. Both folders sort content under Chinese-language subject headings.
Figure 06: Example folder structure and data recovered to the directory.Strategic and IT planning. A folder named oc_cgh_data (31 items, 8.23 MB) contains draft strategic plans covering 2023 through 2028, IT planning documents, service request summaries. Strategy documents reveal internal priorities and program direction, which can be valuable to competitors and attackers alike. The files are sorted under IT规划 (IT Planning), 系统文档 (System Documentation), and 财务 (Finance).
Personnel files and PII. The two largest folders, oc_data (117 items, 130 MB) and oc_gg_data (9 items, 223 MB), hold administrative and personnel material. This includes personal data sheets, SALN forms (Philippine government financial disclosures required of public officials), CVs, résumés, passport-related documents, and employee foreign travel records. Course certificates and IAEA presentation material were also present.
Credential material. A subfolder inside oc_data named KEYS (BitLocker & Docs key) contains a KeePass database, several AxCrypt-encrypted files, and a BitLocker recovery key stored as a PDF.
A CSV file, named after the parent ministry to the nuclear agency, catalogs infrastructure by service and IP, and framework version, alongside credentials and "penetration test" notes. The table below summarizes the entries relevant to this research and exposes a third possible compromise of project management infrastructure related to the same ministry office.
| Finding | Detail |
|---|---|
| Ministry infrastructure mapped | Main website, production and staging project-management application, and a Git service, each recorded with IP, port and framework version |
| Prior pentest credential file | Separately staged spreadsheet described as containing 38 credential sets |
| Validated credential pair | One set of credentials noted as confirmed valid against OwnCloud, separate of the pre-signed URL bypass |
| Project management system IDOR | Noted as confirmed access, with a successful file upload noted against the vulnerable component ID |
| Nuclear Agency OwnCloud access | Roughly 9 GB marked as exfiltrated, filed under folder names not present in the current directory |
The reference to the 9 GB figure, folder names and OwnCloud credentials in the file are not reflected in the 372 MB recovered from the staging folders or Python scripts. This finding suggests the operator's actual access and collection extend far beyond what is accessible in the directory, and that a prior compromise may have supplied both the username:password pairs and data listed here.
Additionally, a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database was recovered from the top-level directory. BioTime is a web-based platform that integrates biometric and RFID access control devices. A full database dump would contain employee-to-badge-ID mappings, department assignments, and access logs. The data covers records through December 2024, and includes internal references to affiliated Philippine government science and research organizations.
Combined with the personnel files above, the time and attendance logs move this activity from simply collecting material for operational purposes, and allows those requesting the data to gain an understanding of high-level personnel who may be identified for further cyber activity.
A Second Victim: WordPress Compromise
The second organization targeted and successfully compromised is a Philippine marine engineering and shipbuilding company that also provides services to the country's Navy. Two distinct attack tools were used against the victim's WordPress site, both showing evidence of admin credential extraction.
CVE-2024-28000 is an unauthenticated privilege escalation vulnerability in the LiteSpeed Cache WordPress plugin, disclosed in August 2024, and affecting versions prior to 6.4. The plugin generates a security hash from a weakly seeded mt_rand() value; an attacker able to enumerate the possible seeds can regenerate the hash, present it with an administrator role cookie and create a new account via the REST API.
A folder named cve28000/ contains the exploit source, main.go. Two separate 15 MB ELFs named wp28000 and wp28000_cp are the compiled builds of that source code. The script reimplements the MT19937 pseudo-random algorithm with byte-for-byte PHP mt_rand() parity. It then verifies that parity against eleven known seed/output pairs on startup, then runs an adjustable number of workers (30 by default) across a seed range of 0 to 999,999. The choice to build and verify MT19937 in-line suggests the operator was very familiar with the internal workings of the vulnerability.
wp28000_cp.log, the accompanying output file, captures full exploitation against the site of which a snippet is provided below:
CVE-2024-28000 - LiteSpeed Cache Privilege Escalation PoC
Target : https://<redacted>/
Seeds : 0 to 999999 (1000000 total)
Threads : 30
[INF] Self-test passed - MT19937 output matches PHP (11 seeds verified)
[INF] Hash generation triggered successfully
[INF] Starting brute-force with 30 threads...
[+] Hash cracked : iMm5pD (seed: 311787)
[+] Username : <redacted>
[+] Password : <redacted>
[+] Login at : https://<redacted>/wp-login.php
[INF] Completed in 13534.99s
CopyRedacted code snippet from wp28000_cp.log showing successful execution
After roughly three hours and 45 minutes, the run landed on seed 311,787, resulting in a newly created administrator account.
A second tool, brute_xmlrpc.py, targets the same site, but through a different WordPress vulnerability. The Python code issues XML-RPC wp.getUsersBlogs calls against /xmlrpc.php with candidate credentials. Every response without a
<fault> element is treated as successful authentication, and the script pauses every ten attempts to evade lockouts.
The operator made use of the well known rockyou.txt wordlist, with a username of admin. An output file named brute_result.txt records a matching credential pair, indicating this path also produced unauthorized access independent of CVE-2024-28000.
Three archives were staged on the directory within a folder named exfil, totaling 195 MB. A complete WordPress installation tree (wp-admin/, wp-content/, wp-includes/, and root level PHP files) were extracted alongside a database dump named APP-DATA-SQL and the site's full media library. The database yields hashed credentials for every user on the site, plugin settings and secret keys stored in wp_options. Combined with the administrator account created through the CVE, and the recovered credential pair via the XML-RPC brute force, the operator has multiple paths back into the environment.
A Separated, Unrelated Attack: Active EtherHiding Compromise on the Same Site
While reviewing the WordPress source, we identified an active, possibly unrelated compromise using EtherHiding techniques. We believe this may be distinct activity from the open directory described above, and none of the evidence reviewed links the two together. The code contains references to "nochain-demo-frame," and an additional script described below.
Figure 07: Malicious Javascript loader found on the compromised Wordpress site.Upon visiting the affected page, a malicious script injected at the top of the source pulls in the ethers.js library from several public CDNs and uses it to read data from an Ethereum smart contract at 0x58460d0b3d4d6b03761c89120393c0c676676496, active as of August 15, 2026. Analysis of transactions associated with the contract revealed that HTML content is stored and dynamically rendered by the NoChain framework, impersonating a Google verification page.
The lure, which is standard for ClickFix attacks, launches pcalua.exe to invoke mshta and download a VBS dropper. Two delivery URLs were identified: fine-work-team[.]com/6272 and timelevel12[.]com/big. A service worker, nochain-sw.js, maintains persistence across repeat visits, while victim fingerprinting data posts to snake.zooparkko[.]com/collect. All domains front through Cloudflare.
A July 2026 blog post from a Japanese-language site specializing in repair and malware removal from WordPress websites flagged the same service worker script as likely malicious, but did not tie the activity to a specific family.
Using identifiers from the loader code including the smart contract address, we created a simple HuntSQL query to determine the prevalence of this attack across other compromised servers:
Example Query:
SELECT
*
FROM
ip.current
WHERE (
html.body.content LIKE '%0x58460d0b3d4d6b03761c89120393c0c676676496%'
AND html.body.content LIKE '%script data-c=%'
AND html.body.content LIKE '%nochain-demo%'
)
CopyOutput:
Figure 08: HuntSQL results querying for HTML pages containing "NoChain" loader strings.The search results in 174 unique IP addresses hosting likely compromised webpages. Two delivery URLs were identified containing the same smart contract and loader script.
Operator Profile and Assessment
From what was observable, Chinese-language script docstrings, log markers, and staging folder names were used at every step of this operation. Beyond establishing the operator's language, their collection was structured: each script identifies its target account and subject focus, downloaded material is sorted into named folders on retrieval. This shows differences to other opportunistic, smash and grab activity, indicating the data was prioritized for follow-on analysis.
Two hypotheses account for the activity described in the preceding sections:
Targeted collection. The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations. The marine engineering firm's ties to the Navy align with interests tied to current South China Sea tensions. The specific material sought out and exfiltrated from the nuclear agency are a separate but complementary priority. The EtherHiding-like compromise on the WordPress site was unrelated/unknown to the operator.
Opportunistic access. The operator exploited what was reachable (from our view of the directory), and may also be behind the NoChain campaign on the WordPress site.
Hunt.io assesses with medium confidence that this activity aligns with targeted collection. The preciseness of the scripts, deliberate organization of stolen data by content, and the nature of the selected data are difficult to reconcile with an opportunistic actor. Based on the operator's tactics and techniques, we do not attribute this to a named threat actor or group.
Mitigations
The following recommendations address the parts of these operations with the clearest defensive fixes: the ownCloud pre-signed URL abuse, the LiteSpeed Cache, and XML-RPC brute force.
Upgrade ownCloud to 10.13.3 or later (or apply ownCloud's specific patch). Instances on versions prior to the fix remain exploitable by anyone who can enumerate valid usernames.
Configure a strong signing key on ownCloud deployments that use pre-signed URLs. An empty or weak signing secret is what the exploit relies on.
Patch the LiteSpeed Cache plugin to version 6.4 or later.
Disable XML-RPC on WordPress installations that do not require it, or restrict /xmlrpc.php to trusted sources. The endpoint is susceptible to credential brute-forcing that bypasses rate limits and other protections.
Enforce strong, unique passwords and multi-factor authentication on administrator accounts. The XML-RPC path succeeded using the well known rockyou.txt wordlist, meaning the compromised password was easily discoverable.
Monitor for WebDAV request patterns consistent with pre-signed URL abuse, including PROPFIND enumeration from a single source and file retrieval occurring across many accounts.
The techniques observed across both directories map to the following:
MITRE ATT&CK Mapping
| Technique ID | Name | Evidence |
|---|---|---|
| T1583.003 | Acquire Infrastructure: Virtual Private Server | Operator staged tooling and exfiltrated data on a VPS hosted at CGI Global Limited (AS56971), Amsterdam. |
| T1587.001 | Develop Capabilities: Malware | Custom Python scripts for ownCloud pre-signed URL abuse (five per-account variants) and XML-RPC brute-forcing |
| T1587.004 | Develop Capabilities: Exploits | Custom Go implementation of the CVE-2024-28000 LiteSpeed Cache exploit, including a PHP-parity MT19937 implementation verified against known seed/output pairs. |
| T1608.002 | Stage Capabilities: Upload Tool | Sliver, Metasploit, Mettle, and the compiled wp28000 exploit binary staged on the same VPS. |
| T1190 | Exploit Public-Facing Application | Exploitation of CVE-2023-49105 against an internet-facing ownCloud instance and CVE-2024-28000 against a LiteSpeed-Cache-enabled WordPress site. |
| T1136.001 | Create Account: Local Account | CVE-2024-28000 exploit created a new administrator account on the WordPress site via the REST API, providing persistent authenticated access. |
| T1110.001 | Brute Force: Password Guessing | XML-RPC brute-forcing against /xmlrpc.php using the rockyou.txt wordlist against the admin account; a successful credential pair was logged to brute_result.txt. |
| T1083 | File and Directory Discovery | WebDAV PROPFIND requests with Depth: 1 used to enumerate ownCloud directories that were not enumerated in advance. |
| T1213 | Data from Information Repositories | Retrieval of documents from ownCloud, a shared file collaboration platform, across five staff accounts. |
| T1074.001 | Data Staged: Local Data Staging | Retrieved files staged in per-account directories (/root/oc_*_data/) and in an exfil/ folder on the operator VPS. |
| T1560 | Archive Collected Data | WordPress site collected as three archives (site tree, database dump, and media library) staged under exfil/ |
Here are the full IOCs from this investigation.
Indicators of Compromise
Table 4: Network infrastructure
| Indicator | ASN | Provider | Country | Context |
|---|---|---|---|---|
| 31.58.209[.]241:8000 | AS56971 | CGI Global Limited | Netherlands | Open directory captured on August 13, 2026 |
Table 5: File Hashes - SHA-256
| Filename | Context | Hash |
|---|---|---|
| multi_backupd | Stage 1 loader on open directory | 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82 |
| stage2_payload.bin | Retrieved from 31.58.209[.]241:8090 | 10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1 |
Table 6: Host & File Indicators - EtherHiding Activity
| Artifact | Type | Context |
|---|---|---|
| 0x58460d0b3d4d6b03761c89120393c0c676676496 | Smart contract address | Observed as part of the NoChain loader, serving ClickFix style payloads |
| fine-work-team[.]com/6272 | Delivery domain | Used within fake Google verification page to deliver VBS dropper |
| timelevel12[.]com/big | Delivery domain | Used within fake Google verification page to deliver VBS dropper |
| snake.zooparkko[.]com/collect | Operator telemetry endpoint | Accepts fingerprint data of visitors to compromised website |
Summary
The operation documented here reflects a pattern that not only the Philippines, but all government and defense-adjacent organizations should expect to continue: patient, per-target collection built around commodity vulnerabilities, seeking to steal sensitive data, or persist on a victim network. The operator authored a custom Go implementation to verify a known CVE, but relied on public exploits, wordlists, and open-source frameworks throughout. Defenders for similar organizations should continue to monitor internet-facing collaboration software and WordPress deployments for this type of activity and prioritize mitigations accordingly.
→ We surfaced this operation by watching exposed infrastructure and pivoting on shared indicators. If your team wants to do the same against its own threat model, start at book a free demo.
Reported cyber intrusion activity by suspected Chinese actors against Philippine government, defense, and critical infrastructure organizations over the past several years has increased with ongoing tensions in the South China Sea. Microsoft's Digital Defense Report 2025 placed the Philippines 20th globally among countries most impacted by cyber activity in the first half of 2025, and noted Chinese state actors targeting the Philippines as part of broader Southeast Asia espionage against IT, government, and academic sectors
On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV. A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.
The operator is likely a Chinese speaker, due to the use of code comments, docstrings, log output, and folders used to sort stolen data containing simplified Chinese.
Key Findings
Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations.
A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim.
Five staging directories associated with the nuclear research entity hold 176 files totaling ~372 MB, sorted under Chinese-language subfolders for their content.
Retrieved material included nuclear-material account records, a research reactor core-component database, employee PII, and credentials stores: BitLocker keys, KeePass, and AxCrypt.
A complete WordPress site archive with core files, uploads, and a database dump were exfiltrated from the second marine engineering victim network.
A 192 MB SQL dump from a ZKTeco BioTime attendance and personnel database, recovered from the same server, referenced multiple related Philippine science and research organizations, indicating a possible focus on tracking individuals working for these institutions.
Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator.
What follows examines each of these findings in turn, beginning with the open directory itself.
The Open Directory
Hunt.io identified the open directory on August 13, 2026 at 31.58.209[.]241:8000, served via Python's built-in SimpleHTTP module. The server, located in Amsterdam, is registered to CGI Global Limited (AS56971).
Figure 01: Hunt.io IP intelligence data for 31.58.209[.]241 hosted on CGI Global Limited exposing ports 22, 8000, and 54329.| Port | Service | Context |
|---|---|---|
| 22 | SSH | OpenSSH 9.6p1 (Ubuntu) |
| 80 | HTTP | Self-hosted OwnCloud login page |
| 8000 | HTTP | The open directory itself (SimpleHTTP/Python) |
| 8080 | HTTP | BaseHTTP/0.6 Python/3.12.3, returns a plain "OK" response |
| 54329 | TCP | Accepts raw TCP connections but returns no data on interaction |
The server hosts an OwnCloud instance on port 80 which possibly serves as a local testing environment. This setup would allow the operator a controlled environment to test out the pre-signed URL technique before sending requests to the intended target.
Figure 02: Self-hosted OwnCloud instance on the attacker-controlled server.The directory contains 1,310 files totaling 1.17 GB across 86 subdirectories, with offensive tooling, exploit scripts, and stolen victim data separated into top-level folders. As of the publication of this research, the server remains accessible.
Offensive Tooling
Three open-source frameworks were also present on the host. None of the recovered logs or configuration tie any of them to the intrusion activity, but their presence alongside malicious code and stolen data suggests the operator retained the tools for testing or future use.
| Tool | Description |
|---|---|
| Sliver | Cross-platform C2 framework written in Go and maintained by Bishop Fox, used in both red-team engagements and adversary operations. |
| Metasploit | Open-source exploitation and post-exploitation framework maintained by Rapid7, providing exploit modules, payload generation, and handler infrastructure. |
| Mettle | Portable, cross-platform Meterpreter implementation designed for embedded and constrained environments, distributed alongside Metasploit. |
In addition to installing and configuring the above projects, the operator also created a stage-1 ELF loader named multi_backupd (SHA-256: 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82).On analysis, the loader connects over TCP to the same IP on port 8090 and pulls a Mettle stage-2 payload, which we retrieved (see IOCs).
Figure 03: Attack Capture file manager displaying the directory contents on 31.58.209[.]241:8000.The bulk of the recovered documents on the server are dedicated to exploiting and retrieving data from an ownCloud instance, which is examined in the next section.
ownCloud Compromise via CVE-2023-49105
ownCloud is an open-source file synchronization and collaboration platform commonly deployed by organizations as a self-hosted alternative to commercial cloud storage. The software's WebDAV interface exposes user files and folders supporting upload, download, and directory enumeration. An internet facing ownCloud deployment run by the nuclear agency, likely used as a shared document repository was the operator's point of access.
In November 2023, ownCloud disclosed CVE-2023-49105, a critical authentication bypass affecting the pre-signed URL mechanism in versions prior to 10.13.1. These URLs were intended to let the platform generate time-limited signed links to files, using a per-instance signing key.
In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.
A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging. Each share the same signing routine:
def compute_hash(url):
return hashlib.pbkdf2_hmac("sha512", url.encode(), b"", 10000, dklen=32) .hex()
def build_signed_url(method, username, url):
parsed = urllib.parse.urlparse(url)
qs = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True)
qs += [("OC-Credential", username), ("OC-Verb", method),
("OC-Expires","1000"), ("OC-Date", "")]
qs_str = urllib.parse.urlencode(qs)
p2 = urllib.parse.ParseResult(parsed.scheme, parsed.netloc, parsed.path, parsed.params, qs_str, parsed.fragment)
sig = compute_hash(urllib.parse.urlunparse(p2))
qs += [("OC-Signature", sig)] ...
CopyCode snippet displaying the shared signing routine targeting ownCloud instances.
The empty bytes literal (b"") passed as the PBKDF2 salt is the signing secret. Properly configured instances would contain a long random string set at install. The scripts assume it is empty, which is the default state CVE-2023-49105 exposes. Each script sets OC-Credential to the account it wants to impersonate and issues GET requests against
/remote.php/dav/files/<account>/<path>, receiving files as that user with no credentials passed.
Beyond exploitation, the operator went to lengths to ensure sustained collection that would not draw the eyes of defenders. The per-account script inserts time.sleep(random.uniform(3, 6)) between requests, while the fifth tightens to a 1.5 to 3.5 second window. Random gaps are meant to evade signatures on outbound traffic and avoid any volumetric detection measures that may be in place.
Docstrings within the code are written in Simplified Chinese, pairing the target account with the area of interest: "低速下载 ... 核材料文档" (low-speed download of nuclear material documents), "低速下载 ... 辐射安全关键文件" (low-speed download of radiation safety key files), and "低速下载 ... IT规划" (low-speed download of IT planning files). Retrieved files are sorted into Chinese-named subject folders inside each per-account output folder, including 财务 (Finance), 辐射安全 (Radiation Safety), 核材料账目 (Nuclear Material Accounts), and IT规划 (IT Planning). The heavy use of Chinese in the docstrings, code comments, and output folders strongly suggests the operator is a native speaker, or very comfortable with the language.
Figure 04: Snippet of oc_hm_dl.py showing the retrieval of radiation safety-related files.The fifth script, titled oc_vps_download.py enumerates the WebDAV directory by issuing PROPFIND requests with Depth: 1, and parsing the returned response blocks. This provides the operator with the ability to recursively search folders not already enumerated. After processing a hardcoded list of individual files the code drops into four selected folders, including two containing BitLocker key material and one containing foreign travel records. Every download attempt writes to a local log at /root/oc_download.log.
These same log files offered an insight into what data the operator was most interested in.
Targeted Material and Personnel Intelligence
After running all five scripts, separate folders were created, holding a combined 176 files totaling 372 MB. oc_vps.out shows the successful download of each file, and matches those present on the directory and its subfolders.
Figure 05: Redacted output from oc_vps.out showing the retrieved files from the ownCloud instance.The stolen documents are broken up across four categories, split in no particular order across the five folders.
Nuclear operations and safety. The oc_km_data folder (13 items, 8.48 MB) holds documents from a reactor operations account: two versions of a database of research reactor core components, historical fuel inventories, and presentation material. oc_hm_data (6 items, ~2 MB) contains documentation on radiation safety, incident reporting, a draft safety manual, and an authorized user list. Together this material provides a technical picture of the facility: reactor configuration, movement histories, and the individuals authorized to interact with that equipment. Both folders sort content under Chinese-language subject headings.
Figure 06: Example folder structure and data recovered to the directory.Strategic and IT planning. A folder named oc_cgh_data (31 items, 8.23 MB) contains draft strategic plans covering 2023 through 2028, IT planning documents, service request summaries. Strategy documents reveal internal priorities and program direction, which can be valuable to competitors and attackers alike. The files are sorted under IT规划 (IT Planning), 系统文档 (System Documentation), and 财务 (Finance).
Personnel files and PII. The two largest folders, oc_data (117 items, 130 MB) and oc_gg_data (9 items, 223 MB), hold administrative and personnel material. This includes personal data sheets, SALN forms (Philippine government financial disclosures required of public officials), CVs, résumés, passport-related documents, and employee foreign travel records. Course certificates and IAEA presentation material were also present.
Credential material. A subfolder inside oc_data named KEYS (BitLocker & Docs key) contains a KeePass database, several AxCrypt-encrypted files, and a BitLocker recovery key stored as a PDF.
A CSV file, named after the parent ministry to the nuclear agency, catalogs infrastructure by service and IP, and framework version, alongside credentials and "penetration test" notes. The table below summarizes the entries relevant to this research and exposes a third possible compromise of project management infrastructure related to the same ministry office.
| Finding | Detail |
|---|---|
| Ministry infrastructure mapped | Main website, production and staging project-management application, and a Git service, each recorded with IP, port and framework version |
| Prior pentest credential file | Separately staged spreadsheet described as containing 38 credential sets |
| Validated credential pair | One set of credentials noted as confirmed valid against OwnCloud, separate of the pre-signed URL bypass |
| Project management system IDOR | Noted as confirmed access, with a successful file upload noted against the vulnerable component ID |
| Nuclear Agency OwnCloud access | Roughly 9 GB marked as exfiltrated, filed under folder names not present in the current directory |
The reference to the 9 GB figure, folder names and OwnCloud credentials in the file are not reflected in the 372 MB recovered from the staging folders or Python scripts. This finding suggests the operator's actual access and collection extend far beyond what is accessible in the directory, and that a prior compromise may have supplied both the username:password pairs and data listed here.
Additionally, a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database was recovered from the top-level directory. BioTime is a web-based platform that integrates biometric and RFID access control devices. A full database dump would contain employee-to-badge-ID mappings, department assignments, and access logs. The data covers records through December 2024, and includes internal references to affiliated Philippine government science and research organizations.
Combined with the personnel files above, the time and attendance logs move this activity from simply collecting material for operational purposes, and allows those requesting the data to gain an understanding of high-level personnel who may be identified for further cyber activity.
A Second Victim: WordPress Compromise
The second organization targeted and successfully compromised is a Philippine marine engineering and shipbuilding company that also provides services to the country's Navy. Two distinct attack tools were used against the victim's WordPress site, both showing evidence of admin credential extraction.
CVE-2024-28000 is an unauthenticated privilege escalation vulnerability in the LiteSpeed Cache WordPress plugin, disclosed in August 2024, and affecting versions prior to 6.4. The plugin generates a security hash from a weakly seeded mt_rand() value; an attacker able to enumerate the possible seeds can regenerate the hash, present it with an administrator role cookie and create a new account via the REST API.
A folder named cve28000/ contains the exploit source, main.go. Two separate 15 MB ELFs named wp28000 and wp28000_cp are the compiled builds of that source code. The script reimplements the MT19937 pseudo-random algorithm with byte-for-byte PHP mt_rand() parity. It then verifies that parity against eleven known seed/output pairs on startup, then runs an adjustable number of workers (30 by default) across a seed range of 0 to 999,999. The choice to build and verify MT19937 in-line suggests the operator was very familiar with the internal workings of the vulnerability.
wp28000_cp.log, the accompanying output file, captures full exploitation against the site of which a snippet is provided below:
CVE-2024-28000 - LiteSpeed Cache Privilege Escalation PoC
Target : https://<redacted>/
Seeds : 0 to 999999 (1000000 total)
Threads : 30
[INF] Self-test passed - MT19937 output matches PHP (11 seeds verified)
[INF] Hash generation triggered successfully
[INF] Starting brute-force with 30 threads...
[+] Hash cracked : iMm5pD (seed: 311787)
[+] Username : <redacted>
[+] Password : <redacted>
[+] Login at : https://<redacted>/wp-login.php
[INF] Completed in 13534.99s
CopyRedacted code snippet from wp28000_cp.log showing successful execution
After roughly three hours and 45 minutes, the run landed on seed 311,787, resulting in a newly created administrator account.
A second tool, brute_xmlrpc.py, targets the same site, but through a different WordPress vulnerability. The Python code issues XML-RPC wp.getUsersBlogs calls against /xmlrpc.php with candidate credentials. Every response without a
<fault> element is treated as successful authentication, and the script pauses every ten attempts to evade lockouts.
The operator made use of the well known rockyou.txt wordlist, with a username of admin. An output file named brute_result.txt records a matching credential pair, indicating this path also produced unauthorized access independent of CVE-2024-28000.
Three archives were staged on the directory within a folder named exfil, totaling 195 MB. A complete WordPress installation tree (wp-admin/, wp-content/, wp-includes/, and root level PHP files) were extracted alongside a database dump named APP-DATA-SQL and the site's full media library. The database yields hashed credentials for every user on the site, plugin settings and secret keys stored in wp_options. Combined with the administrator account created through the CVE, and the recovered credential pair via the XML-RPC brute force, the operator has multiple paths back into the environment.
A Separated, Unrelated Attack: Active EtherHiding Compromise on the Same Site
While reviewing the WordPress source, we identified an active, possibly unrelated compromise using EtherHiding techniques. We believe this may be distinct activity from the open directory described above, and none of the evidence reviewed links the two together. The code contains references to "nochain-demo-frame," and an additional script described below.
Figure 07: Malicious Javascript loader found on the compromised Wordpress site.Upon visiting the affected page, a malicious script injected at the top of the source pulls in the ethers.js library from several public CDNs and uses it to read data from an Ethereum smart contract at 0x58460d0b3d4d6b03761c89120393c0c676676496, active as of August 15, 2026. Analysis of transactions associated with the contract revealed that HTML content is stored and dynamically rendered by the NoChain framework, impersonating a Google verification page.
The lure, which is standard for ClickFix attacks, launches pcalua.exe to invoke mshta and download a VBS dropper. Two delivery URLs were identified: fine-work-team[.]com/6272 and timelevel12[.]com/big. A service worker, nochain-sw.js, maintains persistence across repeat visits, while victim fingerprinting data posts to snake.zooparkko[.]com/collect. All domains front through Cloudflare.
A July 2026 blog post from a Japanese-language site specializing in repair and malware removal from WordPress websites flagged the same service worker script as likely malicious, but did not tie the activity to a specific family.
Using identifiers from the loader code including the smart contract address, we created a simple HuntSQL query to determine the prevalence of this attack across other compromised servers:
Example Query:
SELECT
*
FROM
ip.current
WHERE (
html.body.content LIKE '%0x58460d0b3d4d6b03761c89120393c0c676676496%'
AND html.body.content LIKE '%script data-c=%'
AND html.body.content LIKE '%nochain-demo%'
)
CopyOutput:
Figure 08: HuntSQL results querying for HTML pages containing "NoChain" loader strings.The search results in 174 unique IP addresses hosting likely compromised webpages. Two delivery URLs were identified containing the same smart contract and loader script.
Operator Profile and Assessment
From what was observable, Chinese-language script docstrings, log markers, and staging folder names were used at every step of this operation. Beyond establishing the operator's language, their collection was structured: each script identifies its target account and subject focus, downloaded material is sorted into named folders on retrieval. This shows differences to other opportunistic, smash and grab activity, indicating the data was prioritized for follow-on analysis.
Two hypotheses account for the activity described in the preceding sections:
Targeted collection. The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations. The marine engineering firm's ties to the Navy align with interests tied to current South China Sea tensions. The specific material sought out and exfiltrated from the nuclear agency are a separate but complementary priority. The EtherHiding-like compromise on the WordPress site was unrelated/unknown to the operator.
Opportunistic access. The operator exploited what was reachable (from our view of the directory), and may also be behind the NoChain campaign on the WordPress site.
Hunt.io assesses with medium confidence that this activity aligns with targeted collection. The preciseness of the scripts, deliberate organization of stolen data by content, and the nature of the selected data are difficult to reconcile with an opportunistic actor. Based on the operator's tactics and techniques, we do not attribute this to a named threat actor or group.
Mitigations
The following recommendations address the parts of these operations with the clearest defensive fixes: the ownCloud pre-signed URL abuse, the LiteSpeed Cache, and XML-RPC brute force.
Upgrade ownCloud to 10.13.3 or later (or apply ownCloud's specific patch). Instances on versions prior to the fix remain exploitable by anyone who can enumerate valid usernames.
Configure a strong signing key on ownCloud deployments that use pre-signed URLs. An empty or weak signing secret is what the exploit relies on.
Patch the LiteSpeed Cache plugin to version 6.4 or later.
Disable XML-RPC on WordPress installations that do not require it, or restrict /xmlrpc.php to trusted sources. The endpoint is susceptible to credential brute-forcing that bypasses rate limits and other protections.
Enforce strong, unique passwords and multi-factor authentication on administrator accounts. The XML-RPC path succeeded using the well known rockyou.txt wordlist, meaning the compromised password was easily discoverable.
Monitor for WebDAV request patterns consistent with pre-signed URL abuse, including PROPFIND enumeration from a single source and file retrieval occurring across many accounts.
The techniques observed across both directories map to the following:
MITRE ATT&CK Mapping
| Technique ID | Name | Evidence |
|---|---|---|
| T1583.003 | Acquire Infrastructure: Virtual Private Server | Operator staged tooling and exfiltrated data on a VPS hosted at CGI Global Limited (AS56971), Amsterdam. |
| T1587.001 | Develop Capabilities: Malware | Custom Python scripts for ownCloud pre-signed URL abuse (five per-account variants) and XML-RPC brute-forcing |
| T1587.004 | Develop Capabilities: Exploits | Custom Go implementation of the CVE-2024-28000 LiteSpeed Cache exploit, including a PHP-parity MT19937 implementation verified against known seed/output pairs. |
| T1608.002 | Stage Capabilities: Upload Tool | Sliver, Metasploit, Mettle, and the compiled wp28000 exploit binary staged on the same VPS. |
| T1190 | Exploit Public-Facing Application | Exploitation of CVE-2023-49105 against an internet-facing ownCloud instance and CVE-2024-28000 against a LiteSpeed-Cache-enabled WordPress site. |
| T1136.001 | Create Account: Local Account | CVE-2024-28000 exploit created a new administrator account on the WordPress site via the REST API, providing persistent authenticated access. |
| T1110.001 | Brute Force: Password Guessing | XML-RPC brute-forcing against /xmlrpc.php using the rockyou.txt wordlist against the admin account; a successful credential pair was logged to brute_result.txt. |
| T1083 | File and Directory Discovery | WebDAV PROPFIND requests with Depth: 1 used to enumerate ownCloud directories that were not enumerated in advance. |
| T1213 | Data from Information Repositories | Retrieval of documents from ownCloud, a shared file collaboration platform, across five staff accounts. |
| T1074.001 | Data Staged: Local Data Staging | Retrieved files staged in per-account directories (/root/oc_*_data/) and in an exfil/ folder on the operator VPS. |
| T1560 | Archive Collected Data | WordPress site collected as three archives (site tree, database dump, and media library) staged under exfil/ |
Here are the full IOCs from this investigation.
Indicators of Compromise
Table 4: Network infrastructure
| Indicator | ASN | Provider | Country | Context |
|---|---|---|---|---|
| 31.58.209[.]241:8000 | AS56971 | CGI Global Limited | Netherlands | Open directory captured on August 13, 2026 |
Table 5: File Hashes - SHA-256
| Filename | Context | Hash |
|---|---|---|
| multi_backupd | Stage 1 loader on open directory | 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82 |
| stage2_payload.bin | Retrieved from 31.58.209[.]241:8090 | 10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1 |
Table 6: Host & File Indicators - EtherHiding Activity
| Artifact | Type | Context |
|---|---|---|
| 0x58460d0b3d4d6b03761c89120393c0c676676496 | Smart contract address | Observed as part of the NoChain loader, serving ClickFix style payloads |
| fine-work-team[.]com/6272 | Delivery domain | Used within fake Google verification page to deliver VBS dropper |
| timelevel12[.]com/big | Delivery domain | Used within fake Google verification page to deliver VBS dropper |
| snake.zooparkko[.]com/collect | Operator telemetry endpoint | Accepts fingerprint data of visitors to compromised website |
Summary
The operation documented here reflects a pattern that not only the Philippines, but all government and defense-adjacent organizations should expect to continue: patient, per-target collection built around commodity vulnerabilities, seeking to steal sensitive data, or persist on a victim network. The operator authored a custom Go implementation to verify a known CVE, but relied on public exploits, wordlists, and open-source frameworks throughout. Defenders for similar organizations should continue to monitor internet-facing collaboration software and WordPress deployments for this type of activity and prioritize mitigations accordingly.
→ We surfaced this operation by watching exposed infrastructure and pivoting on shared indicators. If your team wants to do the same against its own threat model, start at book a free demo.
Related Posts
Related Posts
Related Posts
