An attacker GreyNoise has tracked since early June stole more than 18,000 sensitive records from a western government organisation, and the intrusion took under two hours from first malicious request to working database credentials.
GreyNoise runs a sensor network it calls the Global Observation Grid, built to attract attacker scanning so the company can study tooling directly rather than wait for a victim investigation. One IP address kept surfacing in it, and GreyNoise says everything from that address since 7 May 2026 belongs to a single operator. It is withholding the address for now, citing victim sensitivity and operational risk. It assesses the operator is a suspected Chinese speaker, possibly working in UTC+8, based on the operating hours and the Chinese-language comments in their own custom tools, and that they are the same as or related to the actor Acronis has reported as Red Heron, given a shared command server domain, a shared malware family and the same Gitea exploitation in July.
Under two hours from webshell to database
The intrusion began at 01:27 UTC on 22 July, when the operator ran a custom WordPress exploit chain against the site and planted a webshell. Eleven minutes later they had dumped the user table and 13 administrator accounts with it. By 02:05 they had signed into the admin panel and created an account dressed up as a legitimate address on the victim's own domain, backdating its registration to 2025 so it would sit unremarked in the site's account history.
From there the work moved off WordPress. The operator uploaded a custom plugin to enumerate the installation, then used the webshell to survey the host: Defender's settings, the IIS sites, whether MySQL was present, what the WordPress configuration file held. Between 02:31 and 03:07 they cycled through at least 17 script variations trying to bypass Microsoft's Antimalware Scan Interface, steal a SYSTEM token, create a local administrator account and dump the registry. At 03:17 a purpose-built tool swept readable files for cleartext credentials and found working ones for a backend SQL database.
That site was not the only success. GreyNoise counts at least 49 organisations across 29 countries compromised through the same WordPress chain since around 20 July, primarily small business and government. In one, which GreyNoise calls a red-on-red incident, the operator hit a Russian state entity in Russian-occupied Ukraine.
A switch flaw nobody had seen exploited
The other finding is a first. GreyNoise observed the operator exploiting CVE-2026-7273 in ZyXEL GS1900 Smart Managed Switches and says that, as of 17 September 2026, this is the first publicly documented case of that flaw being exploited in the wild; it was not on the CISA Known Exploited Vulnerabilities catalogue at publication. The operator exploited and exfiltrated data from 996 of those switches across 48 countries.
The wider target list runs from PAN-OS GlobalProtect and UniFi OS in June to Proxmox VE in September.
Hints of machine-written tooling
GreyNoise did not identify any specific artificial intelligence tool in use, but suspects a large language model generated the custom tooling, citing behaviour patterns in the code, the rapid iteration and the comments. Its evidence is a tell rather than a proof: between two versions of the same tool, the functionality did not meaningfully change while the content did, churn a human would not bother producing.
Look for the plugin that should not be there
The webshell lived inside a plugin directory named kapibala_plugin, the shell itself at kapibala_index.php taking commands in a kpbl query parameter. Site owners should audit installed plugins against what they actually installed, and treat any administrator account whose registration date sits oddly against the site's history as hostile until proven otherwise. The earlier UniFi activity delivered a backdoor from 74[.]48[.]66[.]73 calling home to p3[.]981666[.]xyz on port 6379, hashing to 2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1. The full account is in GreyNoise's report.
Nothing here needed a novel technique beyond the ZyXEL exploit: an exploitable WordPress install, a webshell and under two hours of patient enumeration, the same shape as a comment-triggered flaw affecting 600,000 sites and the webshells dropped through a WooCommerce plugin patched in February. What separates this case is the record count, and those records are already gone.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.