A suspected Chinese-speaking threat actor has reportedly breached a Philippine nuclear research body and a marine engineering company that provides services to the Philippine Navy, exploiting known vulnerabilities in internet-facing systems to exfiltrate sensitive data. The activity was uncovered by Hunt.io Attack Capture, which identified an exposed server in Amsterdam containing attack scripts, logs, offensive tooling, and data believed to be stolen from the two organizations.
The exposed server, located at 31.58.209[.]241, was identified on August 13, 2026. It hosted a Python SimpleHTTP directory on port 8000, along with SSH and a self-hosted ownCloud login page. The directory contained 1,310 files across 86 folders, totaling 1.17 GB, which included custom Python scripts, per-file transfer logs, open-source offensive security tools such as Sliver, Metasploit, and Mettle, and exfiltrated data.
The primary entry point for the attack on the nuclear research body was likely its internet-facing ownCloud service. The attackers exploited CVE-2023-49105, an authentication-bypass vulnerability affecting ownCloud versions prior to 10.13.1. This flaw allows an attacker who knows a valid username to generate WebDAV requests that the server accepts as authenticated, without requiring a password. This vulnerability is particularly exploitable in instances where no signing key is configured, a default state in new installations, causing the signing routine to execute with an empty secret.
Hunt.io researchers recovered five custom Python scripts from the exposed directory that implemented this technique. Four of these scripts targeted individual user accounts, while a fifth was designed for directory enumeration and logging. The attackers employed random delays in their data collection efforts, likely to avoid detection through volume-based alerts.
The stolen data from the nuclear agency included databases of nuclear reactor components, fuel inventories, radiation-safety documents, incident records, and lists of authorized users. Additionally, strategic plans, IT documents, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials were compromised. While the exposed server contained approximately 372 MB across 176 files, a CSV file created by the attacker referenced roughly 9 GB of stolen material, suggesting that the recovered data represents only a portion of the total exfiltration.
The exposed server also contained a KeePass database, AxCrypt-encrypted files, and a BitLocker recovery key, which could facilitate further access or credential theft. A 192 MB SQL dump from a ZKTeco BioTime attendance and personnel system was also recovered, potentially enabling the attackers to map personnel to badge identifiers, departments, and access records.
For the marine engineering and shipbuilding company, the attackers exploited CVE-2024-28000, a privilege-escalation vulnerability in the LiteSpeed Cache WordPress plugin. This flaw allowed for the creation of an unauthenticated WordPress administrator account by exploiting a predictable security hash through the REST API.
The consistent use of Simplified Chinese in scripts, logs, and folder labels, including terms for nuclear, radiation-safety, finance, and IT files, suggests a Chinese-speaking operator. However, Hunt.io noted that this observation does not definitively link the activity to a specific government or threat group.
Hunt.io disclosed its findings to CERT-PH under the TLP:AMBER sharing standard and delayed public disclosure until August 25, 2026, to allow the national response team to notify the affected organizations. This incident occurs amidst ongoing tensions in the South China Sea and persistent reports of suspected Chinese cyber activity targeting Philippine government, defense, and critical infrastructure entities. The recovered CSV also indicated a possible third victim through the compromise of a project management application.
