- The Mess: Attackers reportedly exploited the old but critical CVE-2023-49105 vulnerability in ownCloud to gain access to systems belonging to a Philippine research organization connected to nuclear research. The case is a sharp reminder that a vulnerability from 2023 can still become a serious problem in 2026 when exposed systems remain unpatched.
The vulnerability itself was patched years ago. That is exactly what makes this case uncomfortable.
According to Hunt.io’s investigation, researchers discovered an exposed attacker-controlled directory containing custom exploit scripts, exfiltration logs, offensive tooling and stolen files connected to a Philippine nuclear research organization and a separate company supporting the Philippine Navy. The suspected operators appear to have used CVE-2023-49105 against an Internet-facing ownCloud instance.
The Attackers Didn’t Need the Victims’ Passwords
CVE-2023-49105 affects certain vulnerable ownCloud configurations using pre-signed URLs without a properly configured signing secret.
In that situation, researchers say an attacker can forge requests that ownCloud accepts as authenticated for a targeted account.
The recovered tooling reportedly included multiple Python scripts designed to abuse this mechanism through ownCloud’s WebDAV functionality. One script focused on directory enumeration, while others targeted individual accounts.
That turns the attack chain into something much more worrying:
Internet-facing ownCloud → authentication bypass → file access → data theft.
No phishing campaign required.
No employee needed to click anything.
No password needed to be guessed.
The Stolen Material Wasn’t Ordinary Corporate Data
The exposed staging infrastructure reportedly contained files associated with nuclear research and operations, including:
- research-reactor component databases;
- nuclear-material and fuel inventory records;
- radiation-safety documentation;
- incident and safety material;
- strategic and IT planning documents;
- employee and personnel information;
- credential-related material.
Researchers also found a KeePass database, encrypted files and a BitLocker recovery key among the collected material.
The files remaining on the exposed server represented only part of what may have been taken.
A recovered CSV reportedly referenced approximately 9 GB of data exfiltrated from the nuclear research organization, while researchers found about 372 MB of staged files still present when they discovered the infrastructure.
That distinction matters.
What researchers found is evidence of the operation.
It may not represent the complete collection.
The Operators Tried to Stay Quiet
The recovered scripts reportedly inserted randomized delays between download requests.
That’s not sophisticated nation-state magic.
It’s something much simpler:
don’t download everything at maximum speed and trigger obvious alarms.
The activity was designed to look less like a massive bulk transfer and more like slower, distributed access over time. Researchers also found Simplified Chinese comments and folder names in the recovered tooling, leading them to assess that the operator was likely Chinese-speaking. That is an attribution clue, not definitive proof of state involvement.
There Was a Second Victim
The same exposed infrastructure contained evidence of another intrusion involving a Philippine marine engineering and shipbuilding company that supports the Philippine Navy.
According to Hunt.io, the operators used CVE-2024-28000 in the LiteSpeed Cache WordPress plugin to gain unauthorized administrative access. Researchers also found evidence of XML-RPC password attacks that obtained valid credentials independently.
So this wasn’t simply:
“Someone found an old ownCloud exploit.”
The recovered infrastructure suggests a broader operation targeting organizations connected to research, sensitive infrastructure and naval support.
Old CVEs Don’t Retire
This is the real lesson.
Security teams love to focus on the newest vulnerability.
The fresh CVE.
The critical zero-day.
The vulnerability currently trending on X.
Meanwhile, attackers often ask a much simpler question:
What is still exposed and unpatched?
If the answer is:
a vulnerability from 2023, that’s perfectly fine for the attacker.
CVE-2023-49105 doesn’t care whether it’s old.
An Internet-facing vulnerable server is still vulnerable.
And in this case, the consequences reportedly included access to highly sensitive research, personnel and credential-related information.
The Fix
If you’re still running an affected ownCloud deployment, patching is obvious.
But configuration also matters.
Organizations should:
- verify that ownCloud is fully updated;
- review pre-signed URL and signing-secret configuration;
- audit Internet-facing instances;
- check WebDAV access logs;
- investigate unusual
PROPFINDenumeration; - look for abnormal access across multiple user accounts;
- review slow, repetitive download patterns;
- rotate credentials and secrets accessible from a potentially compromised server.
And if your server was exposed while vulnerable, don’t assume that installing the patch ends the incident.
The attacker may already have copied the data.
The vulnerability can be closed.
The stolen files can’t be put back.
Bugstoday Opinion
This story is a perfect answer to anyone who says:
“That CVE is from 2023. Surely everyone patched it by now.”
No.
Someone almost always didn’t.
And attackers know it.
The most uncomfortable part isn’t even the technical exploit.
It’s the target selection.
Researchers found evidence of an operation involving a nuclear research organization and a company supporting the Philippine Navy — and the attackers apparently used known vulnerabilities rather than some previously unknown zero-day.
That should be a warning to every organization sitting on old Internet-facing software.
Bugstoday verdict: you don’t need a zero-day to steal sensitive nuclear research data. Sometimes an old vulnerability, an exposed server and years of delayed patching are more than enough.
