Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia Learn More Hunt.io Product Features OEM Pricing About Blog Login Get a Demo To embed a website or widget, add it to the properties panel. Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia Learn More Hunt.io Product Features OEM Pricing About Blog Login Get a Demo To embed a website or widget, add it to the properties panel. Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia Learn More Hunt.io To embed a website or widget, add it to the properties panel. Home Blog Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities Published on Aug 26, 2026 TABLE OF CONTENTS Key Findings The Open Directory ownCloud Compromise via CVE-2023-49105 Targeted Material and Personnel Intelligence A Second Victim: WordPress Compromise Operator Profile and Assessment Mitigations MITRE ATT&CK Mapping Indicators of Compromise Summary Reported cyber intrusion activity by suspected Chinese actors against Philippine government, defense, and critical infrastructure organizations over the past several years has increased with ongoing tensions in the South China Sea. Microsoft's Digital Defense Report 2025 placed the Philippines 20th globally among countries most impacted by cyber activity in the first half of 2025, and noted Chinese state actors targeting the Philippines as part of broader Southeast Asia espionage against IT, government, and academic sectors On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV. A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy. The operator is likely a Chinese speaker, due to the use of code comments, docstrings, log output, and folders used to sort stolen data containing simplified Chinese. Key Findings Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations. A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim. Five staging directories associated with the nuclear research entity hold 176 files totaling ~372 MB, sorted under Chinese-language subfolders for their content. Retrieved material included nuclear-material account records, a research reactor core-component database, employee PII, and credentials stores: BitLocker keys, KeePass, and AxCrypt. A complete WordPress site archive with core files, uploads, and a database dump were exfiltrated from the second marine engineering victim network. A 192 MB SQL dump from a ZKTeco BioTime attendance and personnel database, recovered from the same server, referenced multiple related Philippine science and research organizations, indicating a possible focus on tracking individuals working for these institutions. Simplified Chinese script docstrings, log markers, and folder names point to a Chinese-speaking operator. What follows examines each of these findings in turn, beginning with the open directory itself. The Open Directory Hunt.io identified the open directory on August 13, 2026 at 31.58.209[.]241:8000, served via Python's built-in SimpleHTTP module. The server, located in Amsterdam, is registered to CGI Global Limited (AS56971). Figure 01: Hunt.io IP intelligence data for 31.58.209[.]241 hosted on CGI Global Limited exposing ports 22, 8000, and 54329. Port Service Context 22 SSH OpenSSH 9.6p1 (Ubuntu) 80 HTTP Self-hosted OwnCloud login page 8000 HTTP The open directory itself (SimpleHTTP/Python) 8080 HTTP BaseHTTP/0.6 Python/3.12.3, returns a plain "OK" response 54329 TCP Accepts raw TCP connections but returns no data on interaction Table 1: Ports and services observed on 31.58.209[.]241 The server hosts an OwnCloud instance on port 80 which possibly serves as a local testing environment. This setup would allow the operator a controlled environment to test out the pre-signed URL technique before sending requests to the intended target. Figure 02: Self-hosted OwnCloud instance on the attacker-controlled server. The directory contains 1,310 files totaling 1.17 GB across 86 subdirectories, with offensive tooling, exploit scripts, and stolen victim data separated into top-level folders. As of the publication of this research, the server remains accessible. Offensive Tooling Three open-source frameworks were also present on the host. None of the recovered logs or configuration tie any of them to the intrusion activity, but their presence alongside malicious code and stolen data suggests the operator retained the tools for testing or future use. Tool Description Sliver Cross-platform C2 framework written in Go and maintained by Bishop Fox, used in both red-team engagements and adversary operations. Metasploit Open-source exploitation and post-exploitation framework maintained by Rapid7, providing exploit modules, payload generation, and handler infrastructure. Mettle Portable, cross-platform Meterpreter implementation designed for embedded and constrained environments, distributed alongside Metasploit. Table 2: List of open-source frameworks observed on 31.58.209[.]241 In addition to installing and configuring the above projects, the operator also created a stage-1 ELF loader named multi_backupd (SHA-256: 7447d0d0c34779d4c519823b39bf6ddc16d2b34a226b82ee69da6f5b4a77ad82).On analysis, the loader connects over TCP to the same IP on port 8090 and pulls a Mettle stage-2 payload, which we retrieved (see IOCs). Figure 03: Attack Capture file manager displaying the directory contents on 31.58.209[.]241:8000. The bulk of the recovered documents on the server are dedicated to exploiting and retrieving data from an ownCloud instance, which is examined in the next section. ownCloud Compromise via CVE-2023-49105 ownCloud is an open-source file synchronization and collaboration platform commonly deployed by organizations as a self-hosted alternative to commercial cloud storage. The software's WebDAV interface exposes user files and folders supporting upload, download, and directory enumeration. An internet facing ownCloud deployment run by the nuclear agency, likely used as a shared document repository was the operator's point of access. In November 2023, ownCloud disclosed CVE-2023-49105 , a critical authentication bypass affecting the pre-signed URL mechanism in versions prior to 10.13.1. These URLs were intended to let the platform generate time-limited signed links to files, using a per-instance signing key. In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials. A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging. Each share the same signing routine: def compute_hash(url): return hashlib.pbkdf2_hmac( "sha512" , url.encode(), b "" , 10000, dklen=32) .hex() def build_signed_url(method, username, url): parsed = urllib.parse.urlparse(url) qs = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True) qs += [( "OC-Credential" , username), ( "OC-Verb" , method), ( "OC-Expires" , "1000" ), ( "OC-Date" , "" )] qs_str = urllib.parse.urlencode(qs) p2 = urllib.parse.ParseResult(parsed.scheme, parsed.netloc, parsed.path, parsed.params, qs_str, parsed.fragment) sig = compute_hash(urllib.parse.urlunparse(p2)) qs += [( "OC-Signature" , sig)] ... Copy Code snippet displaying the shared signing routine targeting ownCloud instances. The empty bytes literal (b"") passed as the PBKDF2 salt is the signing secret. Properly configured instances would contain a long random string set at install. The scripts assume it is empty, which is the default state CVE-2023-49105 exposes. Each script sets OC-Credential to the account it wants to impersonate and issues GET requests against /remote.php/dav/files/<account>/<path> , receiving files as that user with no credentials passed. Beyond exploitation, the operator went to lengths to ensure sustained collection that would not draw the eyes of defenders. The per-account script inserts time.sleep(random.uniform(3, 6)) between requests, while the fifth tightens to a 1.5 to 3.5 second window. Random gaps are meant to evade signatures on outbound traffic and avoid any volumetric detection measures that may be in place. Docstrings within the code are written in Simplified Chinese, pairing the target account with the area of interest: "低速下载 ... 核材料文档" (low-speed download of nuclear material documents), "低速下载 ... 辐射安全关键文件" (low-speed download of radiation safety key files), and "低速下载 ... IT规划" (low-speed download of IT planning files). Retrieved files are sorted into Chinese-named subject folders inside each per-account output folder, including 财务 (Finance), 辐射安全 (Radiation Safety), 核材料账目 (Nuclear Material Accounts), and IT规划 (IT Planning). The heavy use of Chinese