Open directory held custom exploit tooling and an EtherHiding loader used against Philippine targets

[u/Straight-Practice-99]

https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor

The Hunt.io research team found an open directory staging the tooling behind an intrusion into a Philippine nuclear agency and a naval contractor.

The custom pieces: a stage-1 ELF loader (multi_backupd) that pulls a Mettle stage-2 over TCP, a Go build of the CVE-2024-28000 LiteSpeed Cache exploit with a PHP-parity MT19937 implementation, and five Python scripts abusing ownCloud CVE-2023-49105 via empty-secret pre-signed URLs. Sliver, Metasploit, and Mettle were also staged on the host.

Separately, on the compromised WordPress site we found an active EtherHiding loader. A malicious script pulls ethers.js from public CDNs and reads HTML from an Ethereum smart contract, rendered via the NoChain framework impersonating a Google verification page, then runs a ClickFix-style lure launching mshta. A HuntSQL query on the contract address returned 174 unique IPs hosting the same loader.

Hashes, domains, and full IOCs: https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor