Philippines: nuclear records taken through a flaw fixed three years ago
Researchers found an attacker's own server sitting open on the internet, and read what was on it. It held the tools and the loot from two intrusions in the Philippines: a nuclear research body and a marine engineering firm that works for the Philippine Navy.
From the nuclear agency: reactor core-component records, nuclear material accounting, fuel inventories, radiation safety reports, staff passports and travel records, and the credential stores including recovery keys. The way in was an authentication flaw published in 2023, in a default configuration.
↓ Download one-page brief (PDF)An attacker leaves their own server open
On 13 August researchers identify an open directory on a host in Amsterdam, served by a basic Python module on port 8000 and holding 1,310 files in 86 subdirectories: custom scripts, transfer logs, offensive tooling and the stolen data itself. The operation was discovered because the operator did not secure their own infrastructure.
Into the nuclear agency through a 2023 flaw
The agency ran an internet-facing ownCloud server. The flaw allows a pre-signed link to be generated when no signing secret is configured, and no signing secret is the default. Five custom Python scripts impersonated valid users and pulled files over WebDAV without ever needing a password, with randomised delays of a few seconds between downloads to avoid looking like bulk collection.
What they took, and how they filed it
Reactor core-component records, nuclear material accounting, fuel inventory histories, radiation safety documents and incident reports, employee personal data including passports and travel records, strategic and IT planning documents running to 2028, and the credential stores - a password manager database, encrypted files and disk recovery keys. The stolen material was sorted into folders labelled in simplified Chinese by category: financial records, radiation safety, nuclear materials accounting, IT planning.
A second victim, through a different door
The same server held evidence of an intrusion into a marine engineering and shipbuilding company serving the Philippine Navy. A WordPress plugin flaw let the attacker derive a security value and create an administrator account; logs show the process ran for nearly four hours before it worked. A separate password-list attack against the site's remote interface also succeeded, giving the operator two independent ways back in.
The badge database
Among the naval supplier's data was a 192 MB dump from an attendance and personnel system: employee-to-badge mappings, department assignments and access logs running to December 2024. That is a map of who works there, in which department, and when they come and go.
Disclosure, and a belated patch deadline
Hunt.io reported to the Philippine national response team under restricted handling and delayed publication until 25 August while notifications were made. On 27 August the American cyber agency added the 2023 ownCloud flaw to its catalogue of vulnerabilities known to be exploited, with a patch deadline for federal agencies of 30 August.
The ownCloud flaw
An authentication bypass in the pre-signed link feature. A pre-signed URL is meant to be a time-limited link signed with a secret; where no secret is configured - the default - the signature can be produced by anyone, so the link authenticates itself. The patch has existed since 2023.
The WordPress plugin flaw
A caching plugin generated a security value predictably enough that an attacker could derive it and use the site's own interface to create an administrator account. Fixed in a later version.
Off the shelf, not bespoke
The post-exploitation software recovered from the server was open-source offensive tooling in common use. The only custom code was the five scripts written to work the ownCloud flaw.
Added to the exploited list
The American cyber agency added the 2023 ownCloud flaw to its known-exploited catalogue with a federal patch deadline of 30 August, three days later.
The operator was found because they left their own directory open on the internet, and their victims were reached because they left their systems unpatched on the internet. The same failure, on both sides, in the same fortnight - which is worth holding onto before this is read as a story about a sophisticated adversary.
A default configuration is what exposed a national nuclear programme
The ownCloud flaw is exploitable when no signing secret is set, and not setting one is the default state. The patch has been available since 2023. The most sensitive records a state holds were reachable without a password because a piece of file-sharing software was left facing the internet in the condition it shipped in. That is a governance failure about what is allowed to be internet-facing, not a technical one about attacker capability.
The personnel data is the part with a long tail
Passports, travel records and a badge database mapping employees to departments and access times. Documents age; people do not. That material supports impersonation, recruitment approaches and physical reconnaissance against nuclear and naval staff for years, and the individuals concerned have no ability to change their travel history.
The attribution is careful and should be carried as carefully
Hunt.io identifies a Chinese-speaking operator from language artefacts and states plainly that they may be state-affiliated, contracted, or working independently. That is not the same as a China-nexus attribution, and no government has made one. Language in code establishes who wrote it, not who paid for it, and the entry should not be firmed up by repetition into something the researchers declined to say.
The 9 GB figure describes what was taken, not what was found
The recovered inventory records roughly nine gigabytes exfiltrated from the nuclear agency, while researchers could directly recover about 372 MB. The gap indicates material had already been moved off the staging server, so the visible evidence is a fraction of the collection, and any assessment of what was lost should use the inventory rather than the recovery.
Under-resourced research bodies holding state-critical data will keep being reached this way
A nuclear research agency is a scientific institution with an institutional budget, not a defence establishment. It holds material of national significance on infrastructure maintained to academic standards. It is highly likely that comparable bodies elsewhere remain reachable through known unpatched internet-facing services, and likely that credential stores and personnel data continue to be a priority alongside the technical records.
Set this beside the Mabna case, where 322 universities were robbed through spear-phishing because research institutions are open by design and defended to academic budgets. Different state, different decade, same structural point: the bodies holding a country's most sensitive scientific material are frequently the least equipped to defend it.
- Inventory what of yours is internet-facing, then justify each one. A file-sharing server at a nuclear agency was reachable from anywhere. The question is not whether it was patched but why it was exposed at all.
- Check the defaults on anything you self-host. This flaw was exploitable precisely because an optional signing secret is unset by default. Shipping configuration is not secure configuration, and nobody is warned when it is left alone.
- Treat credential stores as crown jewels wherever they sit. A password database, encrypted files and disk recovery keys were taken alongside the documents. Their loss extends the incident well past the files that left.
- Protect personnel data as an operational security matter, not a privacy one. Passports, travel records and badge logs enable impersonation and physical reconnaissance against your staff. That is a protective-security exposure with a much longer life than any document.
- Watch known-exploited vulnerability catalogues and act on them. The ownCloud flaw was added to the American list two days after this was published. Those lists are a free, prioritised patch queue and they are not widely used outside government.
- Do not assume a research body has enterprise defences. If you partner with, supply or share data with a national research institution, its security posture is part of yours.
- https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor
- https://securityaffairs.com/198041/intelligence/philippine-nuclear-and-naval-targets-hit-by-suspected-chinese-operator.html
- https://cybersecuritynews.com/hackers-exploit-owncloud/
- https://gbhackers.com/cve-2023-49105-flaw-exploited/
- https://www.scworld.com/brief/suspected-chinese-actor-targets-philippine-nuclear-and-naval-entities-using-known-vulnerabilities
Compiled from open-source reporting for professional security discussion. This is a threat intelligence firm's research finding. Hunt.io assesses the operator to be a Chinese speaker on the basis of language artefacts in code and folder names, and states explicitly that the operator may be state-affiliated, contracted or working independently; it does not attribute the activity to any named group and no government has attributed it. Neither victim organisation has been named. The 9 GB figure derives from an inventory file recovered from the attacker's server rather than from measurement of the data itself, and researchers directly recovered a substantially smaller quantity. Technical indicators are not reproduced here. Details may be revised. This is a protective-security lessons-learned assessment, not an operational account.