PHILIPPINE NUCLEAR AND NAVAL TARGETS HIT BY SUSPECTED CHINESE OPERATOR

**Hacker Pranks Exclusive: Suspected Chinese Operator Breaches Philippine Nuclear and Naval Targets**

A shocking cybersecurity breach has left the international community reeling as a suspected Chinese-speaking operator exploited known vulnerabilities to steal sensitive data from Philippine nuclear and naval targets. The alarming incident, uncovered by Hunt.io, highlights the ongoing threat of cyber attacks against critical infrastructure and the importance of staying vigilant against old and known weaknesses.

According to the report, the attacker targeted a Philippine nuclear research body and a marine engineering company that supports the Philippine Navy, using well-known vulnerabilities in internet-facing ownCloud and WordPress systems. The exposed server contained attack scripts, logs, offensive tooling, and data taken from the two organizations, including nuclear reactor component databases, fuel inventories, radiation-safety documents, and incident records.

**The Attack: A Masterclass in Low-and-Slow Collection**

The attacker's approach was nothing short of ingenious. By exploiting CVE-2023-49105, an authentication-bypass flaw in ownCloud versions before 10.13.1, the attacker was able to generate WebDAV requests that the server accepted as if they were made by a valid user. This allowed the attacker to access sensitive data without ever supplying credentials.

The attacker also used random delays to make data collection less noticeable and avoid volume-based alerts. Scripts, logs, and folders consistently used Simplified Chinese, suggesting a Chinese-speaking operator. However, this does not prove links to a specific government or threat group.

**The Stolen Data: A Treasure Trove of Sensitive Information**

The stolen data included:

* Nuclear reactor component databases * Fuel inventories * Radiation-safety documents * Incident records * Authorized-user lists * Strategic plans * IT documents * Staff records * CVs * Passport and travel data * Financial disclosures from Philippine officials

The exposed server held 176 files, about 372 MB in total. However, a CSV created by the attacker referred to roughly 9 GB of stolen data, suggesting that the server contained only part of the haul.

**The Importance of Patching and Vulnerability Management**

The incident highlights the importance of patching and vulnerability management. Organizations using ownCloud should upgrade to version 10.13.3 or later, apply the vendor's relevant fixes, and ensure that pre-signed URLs use a strong, non-empty signing key. Teams should also examine WebDAV logs for suspicious PROPFIND directory-enumeration requests, large volumes of file retrieval across multiple accounts, or recurring requests from a single source with artificial gaps between them.

For WordPress, organizations should update LiteSpeed Cache to version 6.4 or later, remove or restrict XML-RPC when it is not needed, enforce strong unique administrator passwords, and require multi-factor authentication. The XML-RPC compromise in this case succeeded against a password from a public wordlist, which is not a vulnerability in WordPress so much as an invitation nobody should leave on the doorstep.

**Conclusion**

The breach of Philippine nuclear and naval targets by a suspected Chinese-speaking operator serves as a stark reminder of the ongoing threat of cyber attacks against critical infrastructure. The incident highlights the importance of staying vigilant against old and known weaknesses and the need for organizations to prioritize patching and vulnerability management.

By learning from this incident and implementing best practices, organizations can reduce their risk of being targeted by attackers. Stay tuned to Hacker Pranks for the latest cybersecurity news and analysis.

**Recommended Reading:**

* "The Anatomy of a Cyber Attack: A Case Study" * "The Importance of Patching and Vulnerability Management" * "The Risks of Using Public Wordlists for Passwords"

**Follow us on Twitter:** @HackerPranks

**Subscribe to our newsletter:** [insert newsletter link]

**Join our community:** [insert community link]

Stay safe, stay informed.