Hackers Take Advantage of Vulnerabilities in ownCloud and WordPress to Acquire Philippine Nuclear and Naval Information

Exploited Vulnerabilities Yield Sensitive Data from Philippine Entities

A suspected Chinese-speaking actor has taken advantage of vulnerabilities within ownCloud and WordPress systems to abscond with critical information from a Filipino nuclear research institution and a marine engineering firm associated with the Philippine Navy.

This breach underscores the inherent dangers posed by unpatched, internet-exposed systems, which can lead to the disclosure of data vital to national security.

The incident was uncovered when investigators located an unprotected server rife with tools for the attack, transfer logs, and an assortment of pilfered documents.

Reportedly, the stolen cache encompassed reactor-related records, personnel data, strategic documents, encrypted credential vaults, and a complete backup of a naval contractor’s WordPress site.

On August 13, Hunt.io identified the vulnerable server and traced malicious scripts used in the attacks targeting the two Philippine organizations. Self-hosted OwnCloud instance (Source – Hunt.io)

As detailed in a report by Hunt.io, shared with Cyber Security News (CSN), the evidence strongly indicates the involvement of a Chinese-speaking operator, though no specific group has been explicitly named.

The scope of the breach is alarming. Evidence suggests that approximately 9 GB of data was exfiltrated from the nuclear agency, with researchers able to recover 176 files totaling about 372 MB across five staging directories.

This discrepancy implies that the exposed server represented merely a fraction of the overall data collection endeavor.

Exploitation of ownCloud and WordPress Vulnerabilities

The nuclear agency’s ownCloud platform fell victim to CVE-2023-49105, an authentication bypass flaw in the service’s pre-signed link functionality.

In compromised installations lacking a configured signing key, attackers may issue permitted WebDAV requests for known usernames without the necessity of a password.

Five specialized Python scripts exploited this weakness to systematically download files, accounting for each affected username.

They also employed WebDAV directory requests to identify accessible folders, incorporating intermittent random delays between downloads to mitigate detection during routine oversight. Snippet of oc_hm_dl.py.

This methodical approach diminishes the likelihood of a swift transfer triggering alarms during regular surveillance activities.

The recovered files comprised vital databases on research-reactor core components, fuel inventories, radiation safety documents, incident records, employee resumes, travel itineraries, and financial disclosures.

Investigators also uncovered a KeePass database, files encrypted with AxCrypt, and a PDF housing a BitLocker recovery key—assets that may facilitate future access attempts.

The operator aptly organized the confiscated documents into directories labeled in simplified Chinese, including classifications for financial records, radiation safety protocols, nuclear materials accounting, and IT planning.

Previous analyses on the exploitation of ownCloud have illuminated the critical need for expeditious patching of exposed collaboration systems and rigorous management of credentials.

Broadening Access via WordPress Breach

The second breach targeted a Philippine marine engineering and shipbuilding company linked to naval services.

Attackers capitalized on CVE-2024-28000, affecting pre-6.4 versions of the LiteSpeed Cache plugin, allowing them to create a new administrator account via the WordPress REST API after successfully deriving the plugin’s security hash.

Logs reflected that the exploit persisted for nearly three hours and forty-five minutes before locating a viable value to establish the new account.

Additionally, the perpetrators attempted to breach the site’s XML-RPC interface by guessing passwords for the admin account, successfully recording a functioning credential pair in an isolated output file.

They amassed three archives, aggregating 195 MB, which included the entire WordPress installation, a database dump, and the media library.

This substantial trove can expose password hashes, configuration settings for plugins, and confidential site information, while a rogue administrator account provides an uncomplicated pathway for intruders to return.

Such risks are comparable to previous incidents involving rogue WordPress admin accounts created via various plugin attacks.

Researchers also uncovered an active EtherHiding-style compromise on the same WordPress site, though they noted that there was no direct linkage to the current operator. Malicious JavaScript loader.

This compromise utilized a fraudulent verification web page to upload malware, incorporating a service worker for persistence—a stark reminder of how a single compromised site can harbor multiple threats.

Recent analyses of WordPress sites repurposed as command-and-control servers amplify this broader risk.

Organizations utilizing ownCloud are advised to upgrade to version 10.13.3 or later, implement the necessary vendor patches, and establish robust signing keys.

WordPress administrators ought to update LiteSpeed Cache to version 6.4 or higher, restrict or disable XML-RPC when superfluous, employ strong, unique passwords alongside multi-factor authentication, and scrutinize their administrator accounts.

Furthermore, security teams should monitor for anomalous WebDAV PROPFIND requests across multiple accounts, as such activity patterns remain relevant to ongoing siege campaigns targeting ownCloud.

Indicators of Compromise (IoCs):

Source link: Cybersecuritynews.com.