A suspected Chinese-speaking threat actor breached the WordPress site of an unnamed western government organisation on 22 July 2026, moving from first malicious request to working database credentials in under two hours and exfiltrating more than 18,000 sensitive records from the backend database. The intrusion was documented by GreyNoise researchers Andrew Thompson and Mark Mager in a 21 September report, based not on a victim-side forensic engagement but on the company's own Global Observation Grid, a sensor network built to attract attacker scanning and exploitation onto infrastructure GreyNoise controls. GreyNoise assesses the operator is the same as, or related to, the actor Acronis tracks as Red Heron. The victim organisation has not been named, and no regulator filing or national CERT advisory covering this specific intrusion has been published.
What Happened
GreyNoise has been tracking malicious use of a single IP address since early June 2026 after it surfaced repeatedly in scans and attacks against a wide range of technologies. The company says the address has been hitting its decoys for multiple years, but is confident that all activity from 7 May 2026 onward belongs to one malicious cyber actor. GreyNoise is withholding the address, citing victim sensitivity and operational risk, and has committed to publishing it once those factors are mitigated.
The government intrusion itself ran on a compressed clock. GreyNoise and IntelFusions both place the start at 01:27 UTC on 22 July, when the operator ran a custom WordPress exploit chain against the site and planted a webshell. Eleven minutes later the core user table had been dumped, exposing thirteen administrator accounts. By 02:05 the attacker had authenticated to the WordPress admin panel and created a rogue account styled to look like a legitimate address on the victim's own domain, with the registration timestamp backdated to 2025 so it would blend into the site's account history.
From there the activity moved off the CMS and onto the host. The operator uploaded a custom enumeration plugin, then used the webshell to survey Microsoft Defender settings, the IIS site configuration, whether MySQL was present, and the contents of the WordPress configuration file. Between 02:31 and 03:07 they cycled through at least seventeen script variations attempting to bypass Microsoft's Antimalware Scan Interface, steal a SYSTEM token, create a local administrator account and dump the registry. At 03:17 a purpose-built tool began sweeping readable files across the host.
GreyNoise notes it did not identify any specific artificial intelligence tooling in use, though it suspects AI assistance based on the operator's working patterns. Attribution rests on operational hours consistent with UTC+8, extensive Chinese-language comments inside the actor's custom tools and scripts, and overlap with Red Heron on command-and-control domain, malware family, Gitea exploitation in July and other tradecraft.
What Was Taken
The figures differ slightly by source and should be read as a range. GreyNoise, the primary source, states only "more than 18,000 sensitive records" stolen from the victim's backend database, and quotes itself describing this as "the most egregious data theft" it observed from this operator. SecurityOnline reports a precise count of 18,566 records, a number that does not appear in the GreyNoise report itself and should be treated as that outlet's own accounting rather than a confirmed figure. IntelFusions repeats the "more than 18,000" formulation without a precise total.
Beyond the record count, the actor obtained the full WordPress user table including thirteen administrator accounts, working database credentials, and file-level access to the underlying Windows host. SecurityOnline additionally reports that the same operator compromised 996 ZyXEL network switches across forty-eight countries, and identifies the exploit chain as combining CVE-2026-63030 and CVE-2026-60137 to drop a webshell it calls the kapibala plugin. Those CVE identifiers and the switch count appear in that outlet's reporting and are not independently corroborated in the primary GreyNoise text supplied here.
The nature of the 18,000-plus records, who they pertain to, and whether affected individuals have been notified are all unstated. Because the disclosure originates from a sensor-network vendor rather than the victim, there is no breach notification, no regulator filing and no impact assessment attached to it.
Why It Matters
Three things make this incident worth defenders' attention beyond its raw size.
First, the tempo. Under two hours from initial exploitation to working database credentials leaves essentially no window for human-in-the-loop triage. Any defensive posture that assumes an analyst will review an alert, escalate it and act before the attacker reaches the database is not a posture that would have helped here.
Second, the persistence of the infrastructure. GreyNoise explicitly pushes back on the common view that adversary IP rotation makes blocking pointless. It has watched this single address attack its decoys for years and attributes months of activity to one operator from it. That is an argument for treating IP-level blocking as a live control rather than a deprecated one, at least for some adversaries.
Third, the target class. A public-facing WordPress site is frequently treated as marketing surface rather than production infrastructure, yet in this case it sat on a Windows host with MySQL, IIS and a configuration file holding credentials that led straight to 18,000 sensitive records. The other government breaches in the current reporting cycle make the same point from different angles: Germany's BSI attributes the Berlin Senate compromise to a phishing email leading to a fake CAPTCHA prompt in the TerminalFix campaign, after which Rhysida reconnoitred the network, exfiltrated data via the cloud provider's own copying tools and leaked what WordUp News reports as nearly 1.5 million files totalling 5.79TB covering more than 12,000 individuals, after Berlin refused a 30 bitcoin ransom worth roughly two million euros. Japan's Digital Agency, in its own 11 September statement, disclosed unauthorised access to its Government Solution Service through a vulnerability in a VPN device, detected on 25 June and traced on 9 July; Rescana puts the exposure at approximately 240,000 records of government employees and contractors, a figure the Digital Agency itself does not state. These are separate incidents with separate actors and are not connected to the Kapibala activity, but the pattern across all three is the same: an unglamorous internet-facing component became the whole story.
The Attack Technique
Initial access came through a custom two-stage WordPress exploit chain resulting in webshell deployment. SecurityOnline names the component the kapibala plugin and identifies the chained CVEs as CVE-2026-63030 and CVE-2026-60137; GreyNoise describes the chain and webshell without assigning public identifiers in the material available, so treat the specific CVE pairing as single-source.
Post-exploitation followed a recognisable sequence: dump the user table to identify administrators, authenticate legitimately to the admin panel using recovered credentials, establish persistence through a backdated rogue administrator account designed to survive a casual audit of the user list, then pivot from application-layer access to host-layer access via the webshell. The seventeen-plus AMSI bypass variants attempted between 02:31 and 03:07 indicate an operator iterating live against Defender rather than deploying a pre-validated bypass, which is itself a detection opportunity: a burst of failed script executions in a seven-minute window is noisier than a single clean bypass.
Credential access came from the WordPress configuration file, a standing weakness in the platform's design. Once database credentials were recovered, the bulk record theft followed directly.
What Organizations Should Do
- Treat public-facing CMS installations as production infrastructure. Inventory every WordPress instance your organisation runs, including ones owned by communications or marketing teams, and confirm each is covered by the same patching SLA, logging and monitoring as your core estate.
- Audit WordPress administrator accounts against an authoritative identity source, not against plausibility. The rogue account in this intrusion was designed to look like a real address on the victim's own domain with a 2025 registration date. Reconcile every admin account to a named, currently employed person rather than eyeballing the user list.
- Alert on the specific post-exploitation signature, not just on exploitation. New administrator account creation, user table dumps, plugin uploads from the admin panel and bursts of failed PowerShell or script executions consistent with AMSI bypass attempts should each generate high-priority alerts. The seven-minute window of seventeen failed variants is a clear detection point.
- Reduce credential value in wp-config.php. Use a database account scoped to the minimum privileges WordPress actually needs, restrict database connections to the web host, and ensure the database user cannot read tables beyond the application's own schema.
- Do not dismiss IP-based blocking. GreyNoise's central argument is that at least some adversaries reuse infrastructure over long periods. Ingest and act on reputable scanning and exploitation feeds, and watch for the GreyNoise follow-up publishing the withheld address.
- Apply the same scrutiny to adjacent entry points. The parallel government incidents in this cycle came through a fake CAPTCHA prompt that convinced a user to paste a command into a terminal, and through an unpatched, known, non zero-day VPN vulnerability the agency had already been informed about. Verify your patching position on internet-facing network appliances and make sure user-facing awareness training covers clipboard and terminal-paste lures specifically.
Sources: Hackers stole 18,000 records from a government site IntelFusions | Open Season on Kapibala: Attacker Steals Over 18,000 Government Rec... | Druckversion - BSI explains first attack vector on Berlin authoriti... | Kapibala WordPress Exploitation Attacks Hit Governments | Rhysida leaks 5.7TB of sensitive Berlin state data in major hack –... | Berlin Senate Hack: Consequences to Last Decades | Possibility of Leakage of Personal Information of Employees, etc. b... | Japan Digital Agency GSS Data Breach Exposes 240,000 Records via Un...