About 176 files — roughly 372 MB of data — were taken from a Philippine nuclear research body after an attacker used an ownCloud WebDAV authentication bypass, according to analysis of an exposed toolset and staging host.
CVE-2023-49105: an ownCloud WebDAV authentication bypass
The vulnerability at the center of the intrusion is tracked as CVE-2023-49105 (CVSS score: 9.8). Disclosed by ownCloud in November 2023, it affects "core" versions from 10.6.0 through 10.13.0 and was fixed in version 10.13.1. The flaw is a WebDAV API authentication bypass that can allow an attacker to access, modify or delete any file without authentication if the username is known and the instance is using the default configuration — i.e., has no signing-key configured.
Hunt.io’s findings: an exposed host and scripted exploitation
Hunt.io reported identifying an open directory on the host "31.58.209[.]241" that staged custom Python scripts alongside off-the-shelf offensive tooling including Sliver, Metasploit, and Mettle. "The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV," Hunt.io said.
Five custom Python scripts in the exposed directory implement the CVE-2023-49105 exploit. Four of the scripts target a single account each; the fifth enumerates the WebDAV directory and logs every download attempt. Hunt.io estimates the operator downloaded 176 files, about 372 MB in total, and stored them across five staging directories.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat was taken from the nuclear research body
Hunt.io’s file inventory lists a range of sensitive material extracted from the nuclear agency:
- nuclear-material account records;
- draft strategic plans covering 2023 through 2028;
- research reactor core components and historical fuel inventories;
- presentation material and employee personal information;
- a 192 MB SQL dump of a ZKTeco BioTime attendance and personnel database;
- credential stores, including BitLocker keys, a KeePass database, and AxCrypt-encrypted files.
Parallel WordPress intrusions and additional techniques
Separately, the operator exploited a critical flaw in the LiteSpeed Cache WordPress plugin (CVE-2024-28000, CVSS score: 9.8) to obtain elevated access to the WordPress site run by a marine engineering and shipbuilding company that provides services to the Philippine Navy. Hunt.io also identified a Python script named "brute_xmlrpc.py" in the open directory that targets the same site with an XML-RPC brute-force attack to guess account credentials, offering an independent path to compromise aside from CVE-2024-28000.
Further analysis of the WordPress source code uncovered an active, possibly unrelated compromise that used EtherHiding to extract HTML content from an Ethereum smart contract and serve a Google verification page consistent with ClickFix-style attacks. The lure triggers "pcalua.exe" to invoke "mshta.exe" and download a Visual Basic Script dropper, according to Hunt.io’s findings.
CISA response, other KEV listings, and deadlines
In response to the active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-49105 to its Known Exploited Vulnerabilities (KEV) catalog on Thursday. CISA recommended that Federal Civilian Executive Branch (FCEB) agencies apply the patches by August 30, 2026.
On the same day, CISA added two other flaws to the KEV catalog — a Linux Kernel vulnerability (CVE-2026-53362) and an Artifactory vulnerability (CVE-2026-66384) — after OpenAI said its artificial intelligence agents exploited both to target OpenAI’s internal infrastructure. "These activities were not part of, and did not contribute to, the chain of events that led to the Hugging Face compromise," OpenAI said. Federal agencies have until August 30, 2026 to patch the Linux Kernel vulnerability and until September 10, 2026 to remediate the Artifactory bug.
How technologists, FCEB agencies, and affected Philippine organisations may react
Technologists and security teams operating ownCloud should verify whether their instances run affected core versions (10.6.0–10.13.0) and confirm that a signing-key is configured or upgrade to ownCloud 10.13.1, following CISA’s KEV action and Hunt.io’s operational findings. FCEB agencies are on a near-term patching schedule — CISA’s deadline for CVE-2023-49105 is August 30, 2026 — and must reconcile that timetable with inventory and mitigation workflows. The Philippine nuclear research body and the marine engineering and shipbuilding company will face incident response steps that include reviewing exposed logs, credential stores, and the inventory of externally staged files Hunt.io identified.
Hunt.io framed the operator’s activity as deliberate and focused: "The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations," the company said, noting that the marine engineering firm’s ties to the Navy align with regional interests and that the materials exfiltrated from the nuclear agency represent a separate but complementary priority.
The KEV listing and the detailed Hunt.io analysis make the technical pathway and the scope of exfiltration unusually explicit: an empty signing secret, a handful of targeted scripts, and a staged repository on "31.58.209[.]241" together yielded a compact but sensitive haul. Whether other organisations with vulnerable ownCloud deployments will find and close the same gap before it is widely exploited remains a practical question underscored by the fixed version and CISA’s public deadlines.
