A Chinese-speaking threat actor exploited a critical authentication-bypass flaw in ownCloud — a self-hosted file-sharing platform — to break into a Philippine nuclear research body and steal 176 files totaling about 372 MB. The stolen material included nuclear-material account records, draft strategic plans spanning 2023 to 2028, reactor core component documents, historical fuel inventories, employee personal data, and a database dump that contained BitLocker keys and a KeePass credential store. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability, tracked as CVE-2023-49105, to its Known Exploited Vulnerabilities catalog on August 27, requiring federal civilian agencies to patch by August 30, 2026.
The vulnerability is a WebDAV API authentication bypass (CVSS score: 9.8) affecting ownCloud “core” versions 10.6.0 through 10.13.0. In the default configuration, any attacker who knows a valid username can generate signed WebDAV requests the server accepts as authenticated — without ever supplying a password. Threat intelligence firm Hunt.io identified an exposed staging server used by the attacker that also contained custom Python exploit scripts targeting the same CVE, as well as open-source offensive tooling including Sliver, Metasploit, and Mettle. The same actor separately attacked a marine engineering company with ties to the Philippine Navy, consistent with current South China Sea intelligence-gathering priorities. Simplified Chinese characters found in source code comments and folder structures led Hunt.io to attribute the campaign to a Chinese-speaking operator, though affiliation with a state or contractor has not been confirmed.
How to check if you’re affected
Affected versions of ownCloud are “core” versions 10.6.0 through 10.13.0. If you run a self-hosted ownCloud instance, check your installed version in the admin panel under Settings → General. Update to version 10.13.1 or later, which fixes the flaw. The vulnerability is most dangerous when users have no signing key configured — the default state — so patching is the only reliable mitigation. If patching is not immediately possible, disabling the WebDAV API endpoint reduces exposure.