Executive Summary
In August 2026, a suspected Chinese-speaking threat actor targeted critical Philippine infrastructure, specifically a nuclear research body and a marine engineering firm supporting the Philippine Navy. The actor utilized critical vulnerabilities in self-hosted software, including ownCloud (CVE-2023-49105) and the WordPress LiteSpeed Cache plugin (CVE-2024-28000), to bypass authentication and gain administrative access.
Technical analysis of an attacker-controlled open directory revealed custom Python and Go scripts designed for automated exploitation and data exfiltration. The actor successfully exfiltrated approximately 9 GB of sensitive data, including nuclear-material account records, reactor core components, strategic plans, and employee PII. The operation's focus on personnel intelligence and defense-adjacent sectors suggests a targeted espionage campaign likely influenced by regional South China Sea tensions.
This activity highlights the persistent risk to internet-facing collaboration tools and CMS platforms. While the actor utilized open-source frameworks like Sliver and Metasploit, their ability to develop custom exploits for N-day vulnerabilities demonstrates a sophisticated level of familiarity with target environments.
Key Details
Threat Name
CVE-2023-49105
Affects
ownCloud core 10.6.0 through 10.13.0, LiteSpeed Cache plugin for WordPress, Linux Kernel, Artifactory, ownCloud versions prior to 10.13.1, LiteSpeed Cache WordPress plugin versions prior to 6.4
Adversary
Chinese-speaking threat actor Other Adversaries and Aliases: APT Sidewinder
MITRE Techniques
Malware/Tools
Sliver, Metasploit, Mettle, EtherHiding, multi_backupd