Chinese-Speaking Operator Targets Philippine Nuclear and Naval Infrastructure

Security researchers have identified a suspected Chinese-speaking threat actor targeting Philippine governmental organizations and naval contractors. The adversary is leveraging known vulnerabilities in public-facing web applications to gain initial access, facilitate data exfiltration, and establish persistence. Specific targets included the Philippine nuclear research body and a defense-affiliated naval contractor. The campaign exhibits sophisticated tradecraft, including the use of randomized sleep intervals to evade volumetric network detection and the deployment of an EtherHiding loader mechanism that retrieves malicious payloads directly from Ethereum smart contracts. The operator successfully exfiltrated a 192 MB SQL dump containing ZKTeco BioTime attendance and personnel data. The targeting suggests a strategic interest in Philippine science, research, and defense sectors.

Attack Chain

1. Initial access to ownCloud infrastructure obtained by exploiting CVE-2023-49105 (information disclosure vulnerability).
2. Abuse of WebDAV pre-signed URLs to perform reconnaissance via PROPFIND requests with Depth: 1 headers.
3. Exfiltration of files distributed across multiple compromised user accounts to evade detection.
4. Initial access to a naval contractor via exploitation of CVE-2024-28000 in the LiteSpeed Cache WordPress plugin.
5. Brute force attacks against the WordPress /xmlrpc.php endpoint using wordlists like rockyou.txt to gain administrative or elevated access.
6. Deployment of an EtherHiding loader on a compromised WordPress site to pull secondary payloads from an Ethereum smart contract.
7. Successful exfiltration of a ZKTeco BioTime SQL dump containing personnel and attendance records for affiliated research organizations.

Impact

The breach resulted in the confirmed exfiltration of sensitive personnel records belonging to multiple Philippine science and research organizations. The impact includes the compromise of PII and operational data stored within ZKTeco BioTime systems. Continued exploitation of these vulnerabilities poses a significant risk to regional defense and research entities, with 174 unique IP addresses observed interacting with the malicious loader mechanism alone.

Recommendation

• Patch CVE-2023-49105 on all ownCloud instances immediately.
• Update LiteSpeed Cache plugins to remediate CVE-2024-28000.
• Audit web server logs for PROPFIND requests with Depth: 1 headers originating from anomalous sources.
• Disable /xmlrpc.php on all WordPress installations if not strictly required for business operations.
• Deploy the Sigma rules below to detect brute-force attempts and suspicious WebDAV enumeration.