https://reddit.com/r/netsec/comments/1vyxx41/philippine_nuclear_agency_and_naval_contractor/: ☢️ Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator
Affected Software
Frequently Asked Questions
Which ownCloud deployments are exposed to the WebDAV issue?
Fresh ownCloud installations with an empty signing secret are affected, because that is the default state described for CVE-2023-49105. The issue allows forged pre-signed WebDAV URLs.
What access does an attacker need to exploit the ownCloud weakness?
The described tooling impersonates a target account by setting the OC-Credential header and requesting files under /remote.php/dav/files/<account>/<path>. It retrieves files as that user without credentials and can use PROPFIND with Depth: 1 to enumerate folders.
Were the ownCloud and WordPress/LiteSpeed Cache compromises dependent on one another?
No. The reported activity says the ownCloud CVE-2023-49105 exploitation and the LiteSpeed Cache CVE-2024-28000 exploitation each produced unauthorized access independently.
What additional attack technique was used against the WordPress site?
The reported toolkit included XML-RPC brute forcing with rockyou.txt. A separate EtherHiding compromise was also found on the same WordPress site, although it may be unrelated.