Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of
Analysis Summary
# Incident Report: Exploitation of ownCloud CVE-2023-49105 by Chinese-Speaking Actor
## Executive Summary
A Chinese-speaking threat actor successfully weaponized a critical authentication bypass vulnerability (CVE-2023-49105) in ownCloud to breach a Philippine nuclear research body. The attack resulted in the exfiltration of sensitive nuclear material records, strategic plans, and personnel databases. CISA subsequently added the flaw to its Known Exploited Vulnerabilities (KEV) catalog following the discovery of the actor’s staging server.
## Incident Details
- **Discovery Date:** August 2026 (Reported by Hunt.io)
- **Incident Date:** Ongoing/Detected August 2026
- **Affected Organization:** Philippine Nuclear Research Body; Marine Engineering/Shipbuilding Company
- **Sector:** Government / Research / Defense
- **Geography:** Philippines
## Timeline of Events
### Initial Access
- **Date/Time:** Circa August 2026
- **Vector:** CVE-2023-49105 (ownCloud WebDAV API Authentication Bypass)
- **Details:** The actor used custom Python scripts to generate pre-signed URLs with an empty signing secret. This allowed unauthenticated access to files via WebDAV, provided the attacker knew the target usernames.
### Lateral Movement
- **Details:** The actor utilized open-source offensive security tools, including **Sliver, Metasploit, and Mettle**, to maintain a presence and move within the environment. They also targeted a secondary marine engineering firm via a WordPress vulnerability (CVE-2024-28000) and XML-RPC brute-forcing to expand their footprint.
### Data Exfiltration/Impact
- **Details:** Approximately 372 MB (176 files) were stolen from the nuclear research entity. Data was staged in an open directory on the host `31.58.209[.]241`.
### Detection & Response
- **Detection:** Hunt.io identified an open directory belonging to the threat actor containing stolen data and custom exploit scripts.
- **Response Actions:** CISA added CVE-2023-49105 to the KEV catalog on August 27, 2026, mandating federal agencies to patch.
## Attack Methodology
- **Initial Access:** Authentication bypass via pre-signed URLs (CVE-2023-49105) and WordPress plugin exploitation (CVE-2024-28000).
- **Persistence:** Use of Sliver and Metasploit frameworks; XML-RPC brute-force scripts for secondary access.
- **Privilege Escalation:** Exploitation of LiteSpeed Cache plugin flaw to obtain elevated WordPress permissions.
- **Discovery:** Python scripts used for WebDAV directory enumeration.
- **Credential Access:** Theft of BitLocker keys, KeePass databases, and AxCrypt-encrypted files; SQL dump of personnel databases.
- **Exfiltration:** Data staged on a public-facing VPS (`31.58.209[.]241`) using simplified Chinese naming conventions.
## Impact Assessment
- **Financial:** Unknown; potential long-term costs related to incident response and remediation.
- **Data Breach:** High. Included nuclear material account records, fuel inventories, research reactor components, and a 192 MB SQL dump of the ZKTeco BioTime personnel database.
- **Operational:** Disclosure of strategic plans (2023–2028).
- **Reputational:** Significant impact due to the sensitivity of nuclear research and naval defense data.
## Indicators of Compromise
- **Network Indicators:** `31.58.209[.]241` (Staging/C2 Host)
- **File Indicators:** `brute_xmlrpc.py` (Brute-force script), custom Python exploit scripts for ownCloud.
- **Behavioral Indicators:** Unauthenticated WebDAV requests using pre-signed URLs; simplified Chinese comments in scripts.
## Response Actions
- **Containment:** CISA added the vulnerability to the KEV catalog to accelerate global patching.
- **Eradication:** Recommendation to upgrade ownCloud to version 10.13.1 or higher.
- **Recovery:** Organizations advised to rotate all credentials found in stolen KeePass and BitLocker stores.
## Lessons Learned
- **Default Configurations:** The vulnerability relied on the default absence of a signing key; hardening default settings is critical.
- **Supply Chain & Plugins:** The secondary breach via a WordPress plugin highlights the risk of third-party components in the defense supply chain.
- **Information Exposure:** Staging servers with open directories remain a primary way threat actors are identified and their TTPs analyzed.
## Recommendations
- **Patch Management:** Immediately update ownCloud to version 10.13.1 and WordPress LiteSpeed Cache to the latest version.
- **Configuration Hardening:** Configure a specific `signing-key` in ownCloud to prevent pre-signed URL bypasses.
- **Identity Management:** Implement Multi-Factor Authentication (MFA) to mitigate the impact of stolen KeePass databases and credential stores.