ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Victim

Philippine marine engineering company

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator

Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.

Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.

Security Affairs · 18d agoThreat actor in the wildCVE-2023-49103CVE-2024-28000

Related CVEs

  • CVE-2023-491037.578%
    Unauthenticated phpinfo credential leak in ownCloud graphapi
    CVE-2023-49103 is an unauthenticated information disclosure flaw in ownCloud's graphapi app (0.2.x before 0.2.1 and 0.3.x before 0.3.1), which ships a third-party GetPhpInfo.php page that returns the full PHP phpinfo output when its URL is requested. An attacker with no credentials or user interaction simply accesses that URL over the network, and the phpinfo output reveals all of the webserver's environment variables plus other potentially sensitive configuration details. In containerized deployments these environment variables frequently include the ownCloud admin password, mail server credentials, and license key, giving attackers direct credentials for the server; notably, disabling the graphapi app does not remove the exposed file. Affected deployments are ownCloud installations running the vulnerable graphapi versions, especially ownCloud Docker images built after February 2023, while containers built before February 2023 are not vulnerable to the credential disclosure. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-11-30, the EPSS score is 78.4% (top percentile), and public reporting says threat actors have begun exploiting the flaw, though no public PoC is known.
    · ownCloud graphapi (graphapi app) 0.2.x before 0.2.1; 0.3.x before 0.3.1 KEVlarge
  • CVE-2024-280009.868%
    Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache:
    Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
    · litespeedtech litespeed cache—

Appears with

organization CERT-PH 1organization Hunt.io 1product LiteSpeed Cache 1product ownCloud 1product ZKTeco BioTime 1vendor LiteSpeed 1vendor ownCloud 1vendor WordPress 1vendor ZKTeco 1victim Philippine nuclear research body 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.