CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
A suspected Chinese-speaking actor exploited an ownCloud authentication bypass to breach Philippine nuclear and naval-sector targets, while U.S. agencies seized domains supporting China-linked QTFY tools used against government, defense and critical infrastructure. Two DeFi exploits added immediate financial impact: Ajna v2 lost about $775,400, and an outdated Rain card contract drained about $1.1 million from Avici and Tria programs.
The Philippine intrusions exposed stolen files and offensive tooling, and about 9 GB was reportedly exfiltrated from a nuclear organization. The actor also compromised a marine engineering company supporting the Philippine Navy. The use of an authentication bypass against critical-infrastructure targets makes ownCloud exposure a priority for review.
Trusted delivery and identity channels also failed in concrete ways: a compromised GitHub workflow produced 10 credential-stealing npm releases with valid provenance, Trivy’s release pipeline exposed CI/CD secrets, and stolen employee credentials reportedly enabled 3.6 million directory records to be exported through Microsoft APIs. AnonyMousKIT’s multilingual AI callers add live 2FA theft to that pressure on trust controls.
Editorial: Recommended Actions
01
PRIORITY
Upgrade or isolate internet-exposed ownCloud instances older than 10.13.1, then investigate them for unauthorized access and stolen files. A suspected Chinese-speaking actor exploited an ownCloud authentication bypass to breach Philippine nuclear, naval-support, and other critical-infrastructure targets.
02
PRIORITY
Withdraw quote tokens, repay loans, and stop interacting with Ajna v2 immediately. Attackers manipulated immutable liquidation-accounting logic to drain about $775,400 from seven Ethereum pools, and the protocol has no administrator key, pause mechanism, governance control, or upgrade path.
03
PRIORITY
Audit internet-connected routers, cameras, and IoT devices for compromise associated with QTFY, prioritizing government, defense, and critical-infrastructure environments. U.S. authorities disabled QScan and QTRouter domains, but historical compromised infrastructure may remain active.
04
PRIORITY
Inspect CI/CD histories for Trivy v0.69.4, mutable setup-trivy or trivy-action tags, and the 10 compromised @7nohe/openapi-react-query-codegen releases; rotate credentials or secrets that affected jobs could access. Pin Trivy actions to immutable commits rather than mutable tags. Both incidents involved compromised release workflows and credential-stealing code, while the malicious npm releases retained valid provenance attestations.
05
PRIORITY
Immediately update affected WordPress installations running Avada through 7.16, Fusion Builder through 3.16, GiveWP through 4.16.7.1, Pods through 3.3.9, TranslatePress through 3.3.1, or WPMU DEV Dashboard through 5.0.1. Five critical flaws can enable unauthenticated takeover, privilege escalation, or remote code execution; updates are available, although no exploitation was reported.
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_