Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities

Hunt.io discovered an open directory on an Amsterdam-hosted VPS containing custom exploit scripts, open-source offensive tooling, and exfiltrated data from Philippine government-adjacent organizations; attackers abused ownCloud CVE-2023-49105 (empty signing secret pre-signed URL bypass) to retrieve sensitive nuclear and personnel documents and used CVE-2024-28000 and XML-RPC brute-force to compromise a WordPress site, while also staging a bespoke ELF loader and Mettle payload and hosting EtherHiding-style malicious JavaScript—the report includes IOCs, MITRE ATT&CK mappings, and mitigations.