Loading story…
Hunt.io identified an exposed staging server containing custom tooling, logs, and stolen data linked to intrusions at a Philippine nuclear-research agency and a defense-adjacent marine engineering company serving the Philippine Navy. The operator allegedly exploited ownCloud CVE-2023-49105 to forge pre-signed WebDAV URLs, impersonate users, and collect nuclear operations, personnel, strategic-planning, and credential data; available records indicate roughly 9 GB of data was exfiltrated.
The naval contractor’s WordPress environment was separately compromised through LiteSpeed Cache CVE-2024-28000 and XML-RPC credential brute forcing, after which the actor staged a full website archive and database dump. Researchers assessed with medium confidence that the activity represented targeted collection aligned with Chinese interests amid South China Sea tensions, but did not attribute it to a named group. A separate EtherHiding/NoChain ClickFix infection was also found on the WordPress site, with no evidence tying it to the intrusion operator.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
CISA added ownCloud Server CVE-2023-49105 to its Known Exploited Vulnerabilities catalog, confirming the critical authentication-bypass flaw had been exploited in the wild. The addition followed reporting linking the vulnerability's exploitation to theft of sensitive data from a Philippine nuclear research organization.
Hunt.io disclosed its findings to CERT-PH under TLP:AMBER and delayed public reporting until August 25, 2026, to enable notification of the affected Philippine organizations.
Hunt.io identified an open directory at 31.58.209[.]241:8000, hosted in Amsterdam and served with Python SimpleHTTP. The server contained 1,310 files across 86 directories, including intrusion tooling, logs, and data linked to the Philippine nuclear-research and naval-contractor intrusions.
Reporting associated the activity with the domains fine-work-team.com, timelevel12.com, and snake.zooparkko.com; IP address 31.58.209.241; two SHA-256 hashes; and Ethereum smart-contract address 0x58460d0b3d4d6b03761c89120393c0c676676496.
Researchers identified an active EtherHiding/NoChain compromise on the naval contractor's WordPress site that delivered a fake Google verification ClickFix lure through an Ethereum smart contract. They assessed the activity as potentially unrelated to the suspected Chinese-speaking intrusion operator.
The operator compromised a Philippine marine engineering and shipbuilding company serving the Philippine Navy using LiteSpeed Cache CVE-2024-28000 and XML-RPC credential brute forcing. The actor gained WordPress administrator access and staged archives containing the site installation, media library, and SQL database with password hashes and secret keys.
An attacker-created CSV indicated that roughly 9 GB of data was exfiltrated from the nuclear agency, while 176 retrieved files totaling about 372 MB remained on the staging server. The CSV also recorded confirmed access to a project-management application associated with the agency's parent ministry.
A suspected Chinese-speaking operator exploited ownCloud CVE-2023-49105 to forge pre-signed WebDAV URLs, impersonate accounts, enumerate directories, and retrieve files from a Philippine nuclear research body. The collected material included reactor and fuel records, radiation-safety and incident data, strategic documents, employee PII, and credential-related files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcecommunity.gurucul.com
Open sourcereddit.com
Open sourcehunt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An exposed server tied to the **WP-SHELLSTORM** cybercrime operation revealed tooling, logs, command history, and target lists for a large-scale webshell campaign aimed primarily at **WordPress** sites, with additional targeting of **Joomla** and enterprise Java platforms. Researchers said the group scanned more than **1.4 million domains**, exploited **27 CVEs**—including the Breeze plugin flaw `CVE-2026-3844`—and maintained roughly **5,700 active webshells**, while some analysis put validated compromises as high as **25,195**. The operation used layered implants including BestShell-derived webshells, a **SNOWLIGHT** dropper, and a **VShell** payload disguised as a Linux `kworker` process, then resold access to compromised websites. The exposed infrastructure also linked the operators to a separate campaign against **Nacos** deployments, where they exploited the authentication bypass `CVE-2021-29441` and stole **613 configuration files** from **11 systems** across **nine organizations**. Investigators assessed the activity with medium-to-high confidence as **financially motivated** and likely conducted by **Chinese or Chinese-speaking** operators rather than a state-backed APT, citing Simplified Chinese artifacts, FOFA usage, and overlap between the web and Java intrusion sets. The operators reportedly tried to alter access logs after the server was discovered, but the exposure had already disclosed extensive indicators of compromise and operational details.
Jul 23, 2026
Palo Alto Networks Unit 42 reported a **previously undocumented Chinese threat actor**, tracked as **CL-UNK-1068**, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across **South, Southeast, and East Asia**. Targeted sectors include **aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications**, with Unit 42 assessing **moderate-to-high confidence** that the primary objective is **cyber espionage** (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution. The activity features exploitation of **internet-facing web servers** to deploy **web shells** and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and **living-off-the-land binaries (LOLBINs)**. Reported tooling includes **Godzilla** and **ANTSWORD** web shells, the **Xnote** Linux backdoor, and **Fast Reverse Proxy (FRP)** for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., `c:\inetpub\wwwroot`) focusing on files such as `web.config`, `.aspx`, `.asmx`, `.asax`, and `.dll`, consistent with credential access and follow-on exploitation discovery.
Jun 29, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026