One Exploit Operator, Three Technology Stacks and Thousands of Exposed Government Records

A Chinese-speaking threat actor has combined vulnerabilities in WordPress, Zyxel switches and Ubiquiti UniFi OS to penetrate government, law-enforcement and other high-value networks.

GreyNoise connected the activity through its Global Observation Grid, finding that scans and attacks against multiple technologies originated from a common IP address. The operation has been observed since early June 2026 and is associated with an actor related to the Red Heron threat group.

The WordPress portion reached at least 49 organizations across 29 countries. In one unnamed Western government organization, the attacker stole at least 18,566 records containing accounts, plaintext passwords and personally identifiable information linked to government and law-enforcement agencies.

The same operator compromised 996 Zyxel devices in 48 countries. GreyNoise also observed an intrusion into a Russian state organization in occupied Ukraine, describing it as a “red-on-red” compromise.

WordPress exploit chain opened a route into government databases

The attacker used two WordPress vulnerabilities collectively called “wp2shell”: CVE-2026-60137 and CVE-2026-63030. Public exploits appeared in mid-July, followed within days by active attacks.

CVE-2026-60137 is an SQL injection vulnerability involving the author__not_in parameter in WP_Query. Exploitation becomes possible when a plugin or theme supplies attacker-controlled input to that parameter without adequate sanitization.

It carries a CVSS score of 5.9, with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, and is classified as CWE-89.

NVD’s affected-product entry and its detailed description differ. The product entry lists WordPress versions below 6.8.6, while the description identifies three vulnerable branches:

• WordPress 6.8.x before 6.8.6;
• WordPress 6.9.x before 6.9.5;
• WordPress 7.0.x before 7.0.2.

CVE-2026-63030 is the more severe component, rated 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is categorized as CWE-436 and affects the WordPress REST API batch endpoint.

The vulnerability creates a route-confusion condition. When combined with CVE-2026-60137, it can turn the SQL injection primitive into remote code execution. NVD lists WordPress below 6.9.5 in its product data, while the description covers WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2.

Both flaws entered CISA’s Known Exploited Vulnerabilities catalog on 2026-07-21. The federal remediation deadline was 2026-07-24 for CVE-2026-63030 and 2026-08-04 for CVE-2026-60137.

A 36-minute intrusion progressed from reconnaissance to data theft

Inside the unnamed Western government organization, the actor deployed a customized wp2shell exploit and rapidly examined the Windows environment and its defensive controls.

Reconnaissance covered Microsoft Defender, the Antimalware Scan Interface, listening ports, available services, local accounts, application restrictions and database configuration. Over 36 minutes, the attacker attempted 17 scripts.

Those scripts sought to:

• Bypass AMSI;
• Escalate privileges through token impersonation or theft;
• Create a local administrator account;
• Extract Windows Registry information.

The attacker then located credentials for a backend SQL database. Rather than limiting access to that application account, the operator reused the credentials in a password-spraying attack against the internal environment.

That activity produced access to an internal SQL server and the extraction of at least 18,566 records. The stolen information included plaintext passwords, user accounts and PII associated with government and law-enforcement bodies.

The sequence gives defenders several hunting opportunities: WordPress file or configuration changes, unexpected administrator creation, AMSI bypass attempts, token manipulation, Registry collection, password spraying and unusual bulk SQL queries. Credentials stored in application configurations should be considered exposed if a WordPress host was compromised.

Zyxel campaign harvested configurations and root-level hashes

On August 17, the operator began exploiting CVE-2026-7273 against Zyxel GS1900 Smart Managed Switches. GreyNoise counted 996 compromised devices across 48 countries.

The attacker extracted device configurations, network information and hashed root-level credentials. Even where the hashes cannot immediately be recovered, their theft requires credential rotation and a review for reuse across network infrastructure.

CVE-2026-7273 is a stack-based buffer overflow rated 8.8, with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-121.

NVD’s product list identifies these affected firmware thresholds:

• GS1900-8 before 2.90(aahh.2)C0;
• GS1900-8HP before 2.90(aahi.2)C0;
• GS1900-10HP before 2.90(aazi.2)C0;
• GS1900-16 before 2.90(aahj.2)C0;
• GS1900-24 before 2.90(aahl.2)C0;
• GS1900-24E before 2.90(aahk.2)C0.

However, NVD’s vulnerability description separately names the GS1900-48HPv2 running firmware through 2.90(ABTQ.1)C0. It says an unauthenticated attacker with LAN access can send a crafted HTTP request to the CGI program and potentially execute operating-system commands.

Asset owners should retain both sets of model information during inventory and remediation checks. Validating only one side of the inconsistent NVD record could leave affected hardware unreviewed.

CISA added CVE-2026-7273 to KEV on 2026-09-21 and set 2026-09-24 as the federal remediation deadline. That deadline remains operationally urgent.

UniFi chain combined access control, file access and command injection

The operator also attempted to chain three UniFi OS vulnerabilities for root-level remote code execution:

• CVE-2026-34908, an improper-access-control flaw;
• CVE-2026-34909, a path-traversal vulnerability;
• CVE-2026-34910, an input-validation flaw enabling command injection.

Each vulnerability has a CVSS score of 10.0 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. All three entered CISA KEV on 2026-06-23, with a federal remediation deadline of 2026-06-26.

CVE-2026-34908 allows a network-accessible attacker to make unauthorized system changes. CVE-2026-34909 can expose and manipulate underlying files to reach a system account, while CVE-2026-34910 provides the command-injection capability.

The listed affected products include UniFi OS Server before 5.0.8 and firmware before 5.1.12 for UniFi Cloud Gateway Industrial, Dream Machine, Dream Machine Pro, Dream Machine Special Edition, Dream Machine Pro Max and Enterprise Fortress Gateway.

Organizations should update to at least those thresholds where applicable. Because the actor attempted a chain, checking only for successful command injection may miss earlier unauthorized changes or file-access activity.

The operator scanned beyond the three confirmed attack paths

GreyNoise also confirmed targeting of Palo Alto Networks PAN-OS GlobalProtect, FlowiseAI, Gitea, Nuclio, SENAITE LIMS and Proxmox VE.

The associated vulnerabilities include CVE-2026-56271 in FlowiseAI, CVE-2026-60004 in Gitea, CVE-2026-79756 in Nuclio, CVE-2026-54569 in SENAITE LIMS and CVE-2023-54391 in Proxmox VE. Affected versions and remediation details for these issues are not known from the available campaign data.

The actor also targeted the Linux kernel vulnerability CVE-2022-0847, known as Dirty Pipe. It has a CVSS score of 7.8 and has been in CISA KEV since 2022-04-25, with a federal deadline of 2022-05-16.

Not every issue associated with this cluster is currently in KEV. Catalog presence therefore should not be used as the sole criterion for determining which exposed services require investigation.

Immediate response should combine patching with compromise assessment

Administrators should patch WordPress to 6.8.6, 6.9.5 or 7.0.2, depending on the installed branch. Plugins and themes should be reviewed for attacker-controlled input reaching author__not_in, while logs should be examined for suspicious REST API batch requests.

Zyxel owners need to verify exact hardware and firmware versions against both NVD’s product entries and the separate GS1900-48HPv2 description. UniFi environments should be upgraded to UniFi OS Server 5.0.8 or firmware 5.1.12 and later, as applicable.

Patching alone is insufficient where systems were internet-exposed during active exploitation. Response teams should search for new accounts, backdoors, token abuse, AMSI bypasses, password spraying, SQL extraction and unauthorized configuration changes.

GreyNoise supplied backdoor hashes and command-and-control indicators, although the individual hashes, IP addresses and domains are not publicly listed here. Organizations with access to those indicators should integrate them into endpoint, network and identity searches.

Finally, exposed database, administrator and device credentials should be rotated. That includes plaintext secrets found in application configurations and credentials represented by hashes stolen from Zyxel devices. CISA also requires affected federal agencies to follow BOD 26-04 risk-based remediation and its Forensics Triage Requirements, or discontinue affected products when mitigations are unavailable.