AI-generated editorial illustration; not a documentary photograph.
A Chinese-speaking threat actor exploited vulnerabilities across WordPress, ZyXEL GS1900 switches and several enterprise technologies, reportedly accessing at least 18,566 records from an unnamed Western government organization and compromising 996 network devices. The activity was detected by threat intelligence company GreyNoise and reported by BleepingComputer.
Government database accessed
GreyNoise attributed the campaign to an actor linked to the Red Heron group. Researchers said the attacker used the wp2shell vulnerabilities, CVE-2026-63030 and CVE-2026-60137, in a WordPress Core component to breach at least 49 organizations across 29 countries. The targeted organizations included small businesses and government bodies.
At one unnamed Western government organization, the attacker conducted Windows and security reconnaissance before finding credentials for a backend SQL database. The credentials were then used in a password-spraying attack against an internal SQL server. GreyNoise said the stolen records included accounts, plaintext passwords and personally identifiable information associated with government and law-enforcement agencies.
Network equipment also targeted
Starting August 17, the actor exploited CVE-2026-7273 in ZyXEL GS1900 Smart Managed Switches. GreyNoise said 996 devices in 48 countries were compromised, allowing the attackers to extract device configurations, network information and hashed root-level credentials.
The campaign also targeted Ubiquiti UniFi OS vulnerabilities CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910. CISA had flagged those flaws as actively exploited since late June 2026, according to the report.
Broad exploit set
GreyNoise identified attempted or confirmed targeting of PAN-OS GlobalProtect, FlowiseAI, Nuclio, Proxmox VE, SENAITE LIMS, Gitea and the Linux kernel's Dirty Pipe flaw. The cited issues include CVE-2026-56271 in FlowiseAI, CVE-2026-60004 in Gitea, CVE-2026-79756 in Nuclio and CVE-2023-54391 in Proxmox VE.
The researchers said public exploits for wp2shell appeared in mid-July, with active exploitation observed days later. They also noted that some vulnerabilities connected to the activity were not listed in CISA's Known Exploited Vulnerabilities catalog. GreyNoise published indicators of compromise, including backdoor hashes and command-and-control infrastructure details.
Observed intrusion methods
During one intrusion, the attacker tried 17 scripts over roughly 36 minutes to bypass AMSI, escalate privileges through token impersonation or theft, create a local administrator account and extract registry data. The same activity was also linked to a compromise of a Russian state organization in occupied Ukraine, which GreyNoise characterized as a separate state-on-state incident.
Source: Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
SIGNAL TITANS
Leave a Reply