Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data
A Chinese threat actor exploited critical WordPress vulnerabilities to steal 18,566 sensitive records from a Western government organization across 29 countries.
A Chinese-speaking threat actor exploited the critical WordPress wp2shell vulnerability chain to compromise government and small-business targets across 29 countries, stealing at least 18,566 sensitive records from a Western government organization.
- Chinese-speaking threat actor exploited WordPress critical vulnerability chain to compromise government and small-business targets across 29 countries
- At least 18,566 sensitive records were stolen from a Western government organization
- Attack chain involves two critical vulnerabilities tracked as CVE-2026-63030 and CVE-2026-60137
- Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog
- Threat actors
- Chinese-speaking threat actorMCA
- Malware
- Red Heron
- Organizations
- Western government organization
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63030+1 related CVE | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE | 9.8 group max | 11% | KEVPoC ×9 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.225.153.141 | *.981666.xyz C2 74.48.66.73 Staging <REDACTED> Exploitation 104.225.153.141 C2 Note: IP addresses and domains are intentionally defange |
| ipv4 | 74.48.66.73 | 539e162a516466c0de682dbf9f8a4000b1 Backdoor *.981666.xyz C2 74.48.66.73 Staging <REDACTED> Exploitation 104.225.153.141 C2 Note: IP |
| sha256 | 0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f | es. Indicators of Compromise Indicator of Compromise Note 0e81d80b40eaacbf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f Backdoor 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f8 |
| sha256 | 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 | bf6cb1e817fb1824c30a824af5cb4faca4aa9b03fd506d480f Backdoor 0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 Backdoor 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de68 |
| sha256 | 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1 | 1df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6 Backdoor 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1 Backdoor *.981666.xyz C2 74.48.66.73 Staging <REDACTED> Exp |
From the original article
3 min read at gbhackers.com
A suspected Chinese-speaking threat actor has exploited the critical WordPress “wp2shell” vulnerability chain to compromise government and small-business targets across 29 countries, stealing at least 18,566 sensitive records from one Western government organization. GreyNoise linked the activity to a malicious cyber actor (MCA) it has tracked through its Global Observation Grid since early June. The […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.