Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through Word Press Exploitation
GreyNoise tracked a single malicious actor, a suspected Chinese speaker possibly operating in UTC+8 and linked to the 'Red Heron' activity Acronis reported, from 7 May 2026 onward across WordPress, Ubiquiti, and ZyXEL targets. The actor's WordPress...