Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
GreyNoise identified a suspected Chinese-speaking threat actor ('Red Heron') conducting widespread exploitation across multiple technologies since June 2026. The actor exploited Ubiquiti, WordPress, ZyXEL, Gitea, and other products, stealing over 18,000 sensitive records from a western government. A novel zero-day exploitation of CVE-2026-7273 in ZyXEL GS1900 switches affected 996 devices globally. GreyNoise observed patterns suggesting the actor used LLMs to generate custom attack tools.
- GreyNoise tracked a Chinese-speaking actor ('Red Heron') exploiting multiple vulnerabilities across diverse technologies.
- The actor stole over 18,000 records from a western government via WordPress exploitation (CVE-2026-63030, CVE-2026-60137).
- Novel exploitation of ZyXEL GS1900 switches (CVE-2026-7273) impacted 996 devices across 48 countries.
- GreyNoise suspects the actor used a large language model (LLM) to generate custom tools due to code patterns.
- CVEs
- CVE-2026-7273CVE-2026-34908CVE-2026-34909CVE-2026-34910CVE-2026-63030CVE-2026-60137CVE-2022-0847CVE-2026-60004CVE-2026-56271CVE-2026-79756CVE-2026-54569CVE-2023-54391
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel | 7.8 | 93% | KEVPoC ×4 | KEV |
| CVE-2023-54391 | Authentication bypass in Proxmox VE login API (libpve-access-control) | 9.3 | 2% | ||
CVE-2026-34910+2 related CVEs | Unauthenticated Command Injection in Ubiquiti UniFi OS Devices | 10.0 | 90% | KEVPoC | KEV |
| CVE-2026-54569 | SENAITE.CORE: The SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing… | 9.8 | <1% | ||
| CVE-2026-56271 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and… | 9.3 | <1% | ||
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×5 | KEV |
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×9 | KEV |
| CVE-2026-7273 | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | 8.8 | 3% | KEVPoC | KEV |
| CVE-2026-79756 | Unauthenticated OS Command Injection in Nuclio Dashboard (Local/Docker Platform) | 8.7 | 5% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 981666.xyz | 9f8a4000b1) was delivered to targets. This backdoor used p3.981666[.]xyz:6379 to establish a C2 channel. WordPress On or about 2 |
| ipv4 | 74.48.66.73 | facturing company. In the first round of exploitation using 74.48.66[.]73, a malicious backdoor (2ff2945b13a4cd0e9a65c85af29ea1539e |
| sha256 | 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1 | of exploitation using 74.48.66[.]73, a malicious backdoor (2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1) was delivered to targets. This backdoor used p3.981666[.]x |
From the original article
11 min read at greynoise.io
GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government.
greynoise.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.