Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through Word Press Exploitation
Summary: GreyNoise tracked a single malicious actor, a suspected Chinese speaker possibly operating in UTC+8 and linked to the 'Red Heron' activity Acronis reported, from 7 May 2026 onward across WordPress, Ubiquiti, and ZyXEL targets. The actor's WordPress wp2shell exploitation (CVE-2026-63030 and CVE-2026-60137) succeeded against at least 49 organizations in 29 countries, and one intrusion against a western government organization yielded 18,566 records including accounts, plaintext passwords, and PII tied to law enforcement and government agencies.
What you should know: The 18,566 stolen records included plaintext passwords and law enforcement PII, pulled from a backend SQL database reached through credentials found in readable files and then password spraying - a path that took the actor roughly 90 minutes from initial script activity to data download. Separately, 564 of the 996 compromised ZyXEL switches were still running factory default credentials.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-107441CVE-2026-34908CVE-2026-34909CVE-2026-34910CVE-2026-60137CVE-2026-63030CVE-2026-7273
- Related
- At The Edge Clear: July 20 - 27, 2026 Cyber Risks ·CVE-2026-7273: Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 21, 2026CVE-2026-63030: Word Press Core Interpretation Conflict Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026