Chinese-Speaking Operator Targets Philippine Critical Infrastructure
The Hunt.io research team has uncovered a sophisticated cyber intrusion campaign targeting a Philippine nuclear research agency and a naval contractor. The operator, suspected to be Chinese-speaking, utilized a combination of custom-built tools and known vulnerabilities to gain access and potentially exfiltrate data. The discovery of an open directory containing the full intrusion toolkit provides a rare, detailed look into the methods employed by this threat actor.
The intrusion into the Philippine nuclear agency involved exploiting CVE-2023-49105, a vulnerability in ownCloud that allows for the forging of pre-signed WebDAV URLs. This exploit is particularly potent when the signing secret is left at its default empty state, a common configuration for new installations. Hunt.io identified five custom Python scripts on the compromised server designed to leverage this vulnerability. These scripts manipulate the signing routine by providing an empty bytes literal as the PBKDF2 salt. They then set the 'OC-Credential' header to the account being impersonated and issue GET requests to specific paths within the WebDAV interface. The server, in turn, provides access to files as if the request originated from the legitimate user, bypassing authentication entirely.
Four of these Python scripts are tailored to target specific accounts individually. The fifth script, however, introduces a more advanced capability: it implements PROPFIND enumeration with a 'Depth: 1' setting. This allows the attacker to recursively walk through directories that may not have been pre-enumerated, effectively enabling broader reconnaissance and access within the compromised system. This methodical approach suggests a well-planned operation aimed at achieving deep access and control.
Exploitation of LiteSpeed Cache Vulnerability
The attack on the naval contractor followed a separate vector, exploiting CVE-2024-28000. This vulnerability resides in LiteSpeed Cache, a popular web server performance optimization module. The threat actor developed a custom Go reimplementation of the MT19937 pseudo-random number generator, which is a core component of the exploit chain for this CVE. While the specifics of how this Go reimplementation was used are still being analyzed, it indicates a willingness by the actor to develop bespoke tools to achieve their objectives, rather than relying solely on publicly available exploits.
The use of both a known server-side vulnerability (CVE-2023-49105) and a web application vulnerability (CVE-2024-28000) demonstrates a versatile attack strategy. The choice of targets—a nuclear agency and a naval contractor—points towards an interest in sensitive information related to national security, defense, or potentially dual-use technologies. The fact that the intrusion toolkit was found in an open directory is unusual and could indicate several scenarios: a mistake by the attacker, an intentional misdirection, or a staging ground for further operations that was inadvertently left exposed.
The research by Hunt.io highlights a persistent threat from state-sponsored or state-affiliated actors targeting critical infrastructure in Southeast Asia. The technical sophistication, evidenced by custom scripting and tool development, suggests a well-resourced adversary. The implications for the Philippines are significant, particularly concerning the security of its nascent nuclear program and its naval defense capabilities.
Broader Implications and Unanswered Questions
The technical details published by Hunt.io offer a valuable opportunity for cybersecurity professionals to study and defend against similar attacks. The ability to forge pre-signed WebDAV URLs without a secret is a critical flaw that administrators must be aware of, especially if they utilize ownCloud or similar self-hosted cloud storage solutions. Regularly verifying the signing secret configuration and updating the software are paramount. Similarly, understanding the attack vectors for CVE-2024-28000 and ensuring LiteSpeed Cache installations are patched or configured securely is essential.
What remains unclear is the ultimate objective of the intrusion. Was it solely reconnaissance, data exfiltration, or preparation for sabotage? The presence of the full toolkit in an open directory raises questions about the attacker's operational security. It's possible this was an early-stage staging area, or perhaps a deliberate piece of operational security theater to mislead investigators. The specific attribution to a Chinese-speaking operator is based on linguistic artifacts and toolset commonalities observed by Hunt.io, but definitive state sponsorship is difficult to confirm without further intelligence. Nevertheless, the pattern of targeting critical infrastructure aligns with known activities of certain nation-state actors.
This incident serves as a stark reminder that even organizations dealing with highly sensitive information are vulnerable. The attackers demonstrated a clear understanding of both server-side vulnerabilities and application-level exploits, making them a formidable adversary. The cybersecurity posture of critical infrastructure entities in the region must be continuously assessed and strengthened against such evolving threats.