An unnamed Western government organisation lost its entire backend user database to a suspected Chinese-speaking threat actor who needed less than two hours to go from first malicious HTTP request to working database credentials. The intrusion was documented by GreyNoise researchers Andrew Thompson and Mark Mager in a report published 21 September 2026, drawn not from a victim investigation but from the company's own Global Observation Grid sensor network. GreyNoise puts the haul at "more than 18,000 sensitive records"; several outlets working from the same report, including Cryptika, The Daily Tech Feed, securityonline.info and Undercode News, cite the precise figure of 18,566. The stolen material included accounts, personally identifiable information and plaintext passwords tied to law enforcement and government functions. Secondary coverage places the wider campaign at 49 organisations across 29 countries, a figure that appears in Hackers News, Cryptika, The Daily Tech Feed and Arabian Post but not in the portion of the GreyNoise report available to us.
What Happened
GreyNoise has been tracking a single IP address since early June 2026 for its frequency in scans and attacks across a wide range of technologies. The company says the address has been hitting its decoys for years, but assesses with confidence that all activity from 7 May 2026 onward belongs to one malicious cyber actor. GreyNoise is withholding the address, citing victim sensitivity and operational risk, and has said it will publish an update once those factors are resolved.
The headline intrusion began at 01:27 UTC on 22 July 2026, when the operator fired a custom WordPress exploit chain at a government web portal and planted a webshell delivered as a plugin named kapibala. Eleven minutes later the WordPress user table was dumped, yielding 13 administrator accounts. By 02:05 UTC the attacker had authenticated to the admin panel and created a new account styled to look like a legitimate address on the victim's own domain, backdating its registration to 2025 so it would blend into the site's account history.
The operation then moved off WordPress and onto the host. A custom information-gathering plugin enumerated the installation while the webshell surveyed the machine: Microsoft Defender settings, IIS sites, whether MySQL was present, the contents of the WordPress configuration file, listening ports and local accounts. Between 02:31 and 03:07 UTC the operator cycled through at least 17 script variations attempting to bypass Microsoft's Antimalware Scan Interface, steal a SYSTEM token, create a local administrator account and dump the registry. At 03:17 UTC a purpose-built tool swept readable files for plaintext credentials, which produced access details for a backend SQL database. Arabian Post notes that GreyNoise reconstructed this sequence from preserved file modification timestamps rather than from victim-supplied logs.
Reporting from The Daily Tech Feed adds password spraying, access to internal SQL servers and the staging of sensitive files into ZIP archives for exfiltration, consistent with the credential-to-lateral-movement pattern the rest of the coverage describes.
The WordPress activity was not the whole campaign. GreyNoise also observed the same actor against ZyXEL GS1900 switches, with 996 devices compromised or having data exfiltrated. Cryptika, The Daily Tech Feed and securityonline.info place those devices across 48 countries; Undercode News describes it more loosely as hundreds of devices across dozens of countries. Note that the 48-country switch figure and the 29-country WordPress figure describe different victim sets and should not be conflated.
What Was Taken
The core loss is a backend SQL database belonging to a Western government organisation. Accounts of the volume differ slightly and should be read as a range: GreyNoise, IntelFusions and Arabian Post all say "more than 18,000" records, Hackers News says "over 18,500", and Cryptika, The Daily Tech Feed, securityonline.info and Undercode News report 18,566. The precise figure is the one that appears most often in downstream coverage, but the primary report as quoted uses the rounded form.
The content of those records is the part defenders should sit with. Multiple sources agree the data included user accounts, plaintext passwords and personally identifiable information connected to law enforcement and government agencies. Plaintext password storage in a government-facing system in 2026 is a finding in its own right, and it converts a single web compromise into a credential set usable against every other system those people touch. Separately, the attacker took 13 WordPress administrator accounts from the user table dump and left behind a fourteenth of their own making.
Attribution and Confidence
GreyNoise assesses the operator to be a suspected Chinese speaker, possibly working in UTC+8, based on the operational timeline and what the report describes as copious Chinese-language comments inside the actor's custom tools and scripts. It further assesses the actor is the same as, or related to, the group Acronis has reported as Red Heron, on the basis of a shared command and control domain, a shared malware family, the same Gitea exploitation activity in July, and overlapping tradecraft.
A naming caveat is worth flagging, because coverage has already blurred it. In the GreyNoise report, kapibala is the name of the webshell plugin dropped on victims. Several outlets, notably Undercode News, have promoted it to the actor's name and refer to the operator as "Kapibala". Treat that as an artefact of press coverage rather than a GreyNoise-assigned designation until the vendor says otherwise.
Attribution here is a language and tradecraft assessment, not a state attribution. securityonline.info summarises the status bluntly as a suspected Chinese-nexus actor operating in UTC+8, uncharged. GreyNoise also stated that it did not identify any specific artificial intelligence tooling in use during the intrusion.
The Attack Technique
The initial access vector is a two-stage chain the reporting calls wp2shell, combining CVE-2026-63030 and CVE-2026-60137. Arabian Post gives the most specific technical description: CVE-2026-63030 is a WordPress REST API batch-route confusion flaw, and CVE-2026-60137 is an SQL injection weakness in WP_Query. Used together against a vulnerable installation, the pair allows an unauthenticated attacker to reach the database and achieve remote code execution. Arabian Post also reports that WordPress exploitation in this campaign began around 20 July 2026, two days before the government intrusion.
What makes the chain dangerous is less the individual bugs than what follows them. The operator treated the CMS as a beachhead, not an objective: webshell, user table, persistent admin account with a forged registration date, custom enumeration plugin, host reconnaissance, AMSI bypass attempts, privilege escalation, credential harvesting from readable files, then pivot into internal SQL infrastructure. The 17 AMSI bypass variations in a 36-minute window suggest a prepared toolkit being iterated against live defences rather than improvisation, and the 2025 backdating on the rogue admin account shows an operator thinking about the incident responder who will eventually read the account list.
Why It Matters
Three things generalise beyond this victim.
First, the exposure model. GreyNoise found this campaign by watching its own decoys, not by responding to a breach. The operator is opportunistically scanning and hitting whatever answers: WordPress sites, network switches, development platforms such as Gitea, enterprise applications. Every exposed appliance, management interface and forgotten marketing CMS is part of the same attack surface as far as this actor is concerned.
Second, the tempo. Under two hours from first request to database credentials leaves no room for a detection pipeline that batches alerts hourly or a triage queue that works business hours in the victim's timezone. An operator working UTC+8 against a Western target is, by construction, working while the defenders are asleep.
Third, the IP blocking question. GreyNoise explicitly pushes back on the received wisdom that adversary IP addresses rotate too fast for blocking to be worthwhile, noting it has watched this single address attack its sensors for multiple years. That does not make blocklists a strategy, but it does mean dismissing durable infrastructure indicators outright is a mistake in at least some cases.
What Organizations Should Do
- Patch WordPress core, themes and plugins now, with specific attention to CVE-2026-63030 and CVE-2026-60137. If you run WordPress on an internet-facing government or enterprise host, treat this as urgent rather than routine.
- Audit every administrator account, including registration dates. The rogue account in this intrusion was backdated to 2025 specifically to survive a casual account review. Compare account lists against an authoritative directory, not against what the CMS says about itself.
- Hunt for the kapibala plugin and unexplained plugin uploads. Unexpected plugins, unfamiliar PHP files in upload directories and plugin install events with no change ticket behind them are the artefacts here.
- Rotate everything the webshell could read. That means WordPress salts, database credentials in wp-config, service account passwords and any credential sitting in a readable file on the host. Kill active sessions after rotation.
- Eliminate plaintext credential storage and audit for it proactively. The severity of this breach is driven by what was in the database, not just that the database was reached. Run a credential-pattern sweep against your own backend stores before someone else does.
- Extend the review to non-CMS assets. Check ZyXEL GS1900 switches and comparable managed network appliances for unauthorised configuration changes or exfiltration, and get management interfaces off the public internet.
- Instrument for AMSI bypass attempts, SYSTEM token manipulation and registry dumping on web servers. Repeated script execution from a webserver process account is the loudest signal in this entire timeline and the point at which a two-hour intrusion could have been cut short.
Sources: Critical WordPress Flaws Let Attackers Steal Government Records, Pl... | Open Season on Kapibala: Attacker Steals Over 18,000 ... - GreyNoise | Hackers stole 18,000 records from a government site IntelFusions | Kapibala WordPress Exploitation Attacks Hit Governments | Hackers Exploit WordPress Flaws to Steal 18,566 Government Records... | WordPress Flaws Lead to Theft of 18,566 Gov Records & Plaintext Pas... | Hackers widen WordPress attacks across 29 countries — Arabian Post | Kapibala’s WordPress Campaign Exposes 18,566 Government Records as...