Chinese-Speaking Hackers Hit Philippine Nuclear Research Agency Through ownCloud Bug

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency added ownCloud flaw CVE-2023-49105 to its Known Exploited Vulnerabilities catalog on Thursday.
• The bug carries a severity score of 9.8 out of 10 and lets attackers reach files without a valid password.
• A Chinese-speaking hacking crew used the flaw to break into a nuclear research organisation in the Philippines.
• Federal civilian agencies in the United States must patch affected systems within 21 days.
• OwnCloud published a fix and mitigation guidance in November 2023, but many servers remain unpatched.

CISA, the federal body that tracks active hacking campaigns, has warned that a serious flaw in ownCloud is being used in real attacks. OwnCloud is a file-sharing and storage platform used by government agencies and universities to keep documents on their own servers rather than in the public cloud. The agency added the bug to its Known Exploited Vulnerabilities catalog on Thursday, a legal trigger requiring federal civilian agencies to patch within 21 days.

The flaw, CVE-2023-49105, is rated 9.8 out of 10 for severity. It lets an attacker access or delete files on a vulnerable ownCloud server without a valid password.

Who got hit?

A nuclear research organisation in the Philippines was breached using the bug, according to reporting from The Hacker News. The attackers were a Chinese-speaking group targeting a body that handles sensitive scientific records. We've followed Chinese state-linked cyber activity closely in recent months, including our 13 August report on Jewelbug, the hacker-for-hire outfit breaking into Middle Eastern government systems.

No public ransom demand has surfaced. This looks like espionage, not extortion. State-linked crews tend to steal data quietly rather than lock files and demand payment.

What is the flaw, exactly?

It's an authentication bypass: the software failed to check who was on the other end of a request, so an outsider could act as a trusted user. Once inside, an attacker could pull down files, poke around accounts, and move deeper into the network.

OwnCloud disclosed the issue in November 2023 and published a fix immediately. Many organisations, judging by the fresh exploitation, still haven't applied it more than a year later.

Should ordinary people worry?

Probably not directly, but it matters. If your employer runs ownCloud, IT staff should already be patching. Anyone whose data may have been held by the affected Philippine agency should watch for unusual emails appearing to come from that body. Stolen document caches routinely surface later in phishing campaigns, where criminals send convincing fakes quoting real details lifted from the breach.

The numbers

CISA's move should push more organisations to act. The bug has been public for over a year, the fix has been available just as long, and attackers are still finding unpatched servers. That's the real story here: not the flaw itself, but how long an easy fix can sit ignored.