NoChain

☢️ Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator : r/netsec

Hunt.io identified an exposed staging server containing custom tooling, logs, and stolen data linked to intrusions at a Philippine nuclear-research agency and a defense-adjacent marine engineering company serving the Philippine Navy. The operator allegedly exploited ownCloud CVE-2023-49105 to forge pre-signed WebDAV URLs, impersonate users, and collect nuclear operations, personnel, strategic-planning, and credential data; available records indicate roughly 9 GB of data was exfiltrated. The naval contractor’s WordPress environment was separately compromised through LiteSpeed Cache CVE-2024-28000 and XML-RPC credential brute forcing, after which the actor staged a full website archive and database dump. Researchers assessed with medium confidence that the activity represented targeted collection aligned with Chinese interests amid South China Sea tensions, but did not attribute it to a named group. A separate EtherHiding/NoChain ClickFix infection was also found on the WordPress site, with no evidence tying it to the intrusion operator.

Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities