Western Government Agency: Chinese-Speaking Actor Steals 18,566 Records via WordPress Exploit Chain

A suspected Chinese-speaking threat actor turned a public-facing WordPress site into a beachhead for a full internal compromise, walking away with thousands of government records including plaintext passwords. GreyNoise, which observed the activity directly through its Global Observation Grid sensor network, reports "more than 18,000 sensitive records" stolen from a single western government; secondary coverage citing a GreyNoise report shared with Cyber Security News puts the precise figure at 18,566 records pulled from a backend SQL database. The same actor is reported to have breached at least 49 institutions across 29 countries, though that scoping figure appears in downstream coverage (The Daily Tech Feed, Cryptika) rather than in the portion of GreyNoise's own published analysis available here. The entry vector was the "wp2shell" chain, CVE-2026-63030 and CVE-2026-60137, which CrowdSec ranks as the single most widely exploited vulnerability it tracks.

What Happened

GreyNoise says it has been tracking a specific malicious IP address since early June 2026 because of its persistent scanning and exploitation across multiple technologies, and assesses with confidence that activity from 7 May 2026 onward belongs to a single malicious cyber actor. The attribution to a Chinese speaker rests on two things: an operational timeline consistent with UTC+8, and what GreyNoise describes as "copious amounts of Chinese language comments" inside the actor's custom tooling and scripts. GreyNoise further assesses the actor is the same as, or related to, the group Acronis reported as "Red Heron," based on a shared command-and-control domain, a shared malware family, Gitea exploitation in July, and overlapping TTPs. GreyNoise is withholding the IP address for now, citing victim sensitivity and operational risk, and says it will publish an update once those concerns are resolved.

The government intrusion itself began on 22 July 2026. The actor used the wp2shell chain to drop a custom webshell on a vulnerable WordPress server, then dumped the WordPress user table, capturing 13 administrator accounts, and planted an additional administrator account crafted to resemble a legitimate address within the victim's own domain. A custom plugin was used to enumerate the installation while the webshell handled reconnaissance and command execution. Per Cryptika's account of the GreyNoise findings, the actor inventoried security tooling, running services, listening ports, database configuration files, and local accounts before attempting to weaken defenses and escalate privileges. From there the operation moved off the website and into the environment: credential harvesting from readable files, password spraying, access to internal SQL servers, and staging of sensitive files into ZIP archives for exfiltration.

WordPress was not the only target surface. The same actor is reported to have gone after ZyXEL GS1900 network switches, compromising or extracting data from 996 devices across 48 countries. That pattern, indiscriminate scanning of whatever is exposed, is the defining characteristic here.

A note on scope: three of the sources in this brief (Check Point Research, The Hacker News, Cypro) cover StopAndProtect, a separate criminal operation that abuses hacked WordPress sites as malware and C2 infrastructure. Infosecurity Magazine's reporting covers a third distinct WordPress attack path, a WooCommerce plugin flaw. These are different campaigns with different actors and motives. They are included below because together they show how much hostile activity is currently converging on the same platform, not because they are the same incident.

What Was Taken

The core loss is 18,566 records from one western government agency, per the figure attributed to GreyNoise in downstream reporting; GreyNoise's own published wording is the more conservative "more than 18,000." Both figures describe the same intrusion and the same SQL database.

The contents are the problem. The haul included user accounts, plaintext passwords, and personally identifiable information tied to law enforcement and government sectors. Plaintext credentials from a law enforcement dataset are not a one-time loss; they are a reusable key. Every one of those passwords is now a candidate for credential stuffing against other government systems, and any reuse across personal and professional accounts extends the blast radius well past the breached agency. Separately, the actor took 13 WordPress administrator accounts from the user table dump, and maintained persistence through a fake administrator account styled to look like part of the victim's domain infrastructure.

On the ZyXEL side, 996 switches across 48 countries were compromised or had sensitive information exfiltrated, though the nature of that data is not detailed in available reporting.

For context on the unrelated StopAndProtect operation, Check Point's investigation was enabled by the operators' own OPSEC failures, which exposed infection logs, victim screenshots, and the source code of their site-management tooling. Check Point describes "thousands" of hacked WordPress sites; The Hacker News and Cypro both settle on "nearly 2,000" compromised domains, with Cypro adding over 5,000 infected devices and at least 250 distinct infected sites tracked across 12 countries. Most affected IPs belong to the US, Russia, and India.

Why It Matters

The marketing website is not a low-value asset. It is an internet-facing server that often sits inside, or adjacent to, the same network as things that matter, and it is frequently owned by a communications team rather than a security team. This incident is a clean demonstration of the pivot: CMS compromise, credential harvest, lateral movement, internal SQL access, bulk exfiltration. Nothing exotic was required.

The patch window was effectively zero. CrowdSec's timeline is worth reading closely. WordPress shipped fixes 6.9.5 and 7.0.2 on 17 July 2026. CrowdSec's detection rule went live on 20 July and matched live traffic the same day. CISA added CVE-2026-63030 to its Known Exploited Vulnerabilities catalog on 21 July with a remediation deadline of 24 July. As CrowdSec puts it, "there was no quiet period in which to schedule the patch." The government intrusion began 22 July, five days after the fix shipped.

The exploitation volume is without precedent in CrowdSec's dataset: 62,802 unique attacking IP addresses in a rolling 15-day window, surpassing the previous record holder, the NETGEAR DGN1000 command injection flaw CVE-2024-12847, which recorded 51,404 over the same window. Full technical details were published by Searchlight Cyber, multiple proof-of-concept exploits are circulating, and a public Nuclei template exists. This is not a targeted capability; it is commodity.

That commoditization is also why the other campaigns in this brief matter. Infosecurity Magazine reports that Wordfence blocked more than 100,000 exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin, four months after a patch shipped, against an install base of only about 6,000 sites. Whether the entry point is core, a premium plugin, or injected JavaScript serving fake CAPTCHAs, the WordPress estate is being worked over continuously by actors ranging from ransomware crews to state-adjacent espionage operators.

The Attack Technique

wp2shell (CVE-2026-63030 + CVE-2026-60137). Per CrowdSec, CVE-2026-63030 is a CVSS 9.8 REST API batch-route confusion flaw (CWE-436) affecting WordPress core 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Chained to CVE-2026-60137, a blind SQL injection in WP_Query, it gives an unauthenticated attacker database read access and a path to remote code execution. No authentication is required. Fixed versions are 6.9.5 and 7.0.2, plus 7.1 Beta 2.

Post-exploitation followed a consistent sequence: custom webshell deployment, user table dump, rogue administrator account creation using a name mimicking the victim's legitimate domain, custom plugin for installation enumeration, then host reconnaissance covering security products, services, listening ports, database config files, and local accounts. Credentials recovered from readable files fed password-spraying against internal systems, which produced SQL server access and, finally, ZIP-staged exfiltration. GreyNoise notes it did not identify any specific AI tooling in use, though it suspects the actor made use of it.

The WooCommerce vector (CVE-2026-27540). Distinct from the above but worth patching in the same sweep. The Wholesale Lead Capture plugin from Rymera Web Co exposes an AJAX action, wwlc_file_upload_handler, reachable by unauthenticated visitors. Wordfence found the allowlist of permitted file extensions is read from the request itself rather than server-side configuration, letting an attacker supply their own list including php. The plugin compounds this by calling WordPress's upload function with type checking disabled. Attackers submit a forged settings parameter alongside a PHP file, typically shell.php. Wordfence rates it CVSS 9.8; the Patchstack-issued CVE record carries 9.0, a gap that turns on how attack complexity is scored. Fixed on 20 February in version 2.0.3.2.

StopAndProtect (separate operation). Check Point's chain starts with ClickFix social engineering, a fake Cloudflare human-verification CAPTCHA served from injected JavaScript on compromised sites, prompting the victim to paste and run a PowerShell command. That leads to two stages of .NET downloaders and loaders, then a modular toolkit: ransomware, SMB/USB worm, LockScreen, VBS spreader, a credential stealer, and a chat utility for talking to victims. Notably, ransomware is not always deployed; in many cases the operators quietly exfiltrate file listings and then specific files.

What Organizations Should Do

1. Patch WordPress core now and verify the version, not the intent. Upgrade to 6.9.5, 7.0.2, or later. Given exploitation began within 72 hours of the fix, any instance patched after 20 July 2026 should be treated as potentially compromised, not as remediated. Extend the same urgency to themes and plugins, including premium ones (WooCommerce Wholesale Lead Capture must be at 2.0.3.2 or later).

2. Audit every administrator account against a known-good list. The actor's persistence mechanism was an account named to blend into the victim's own domain. A quick visual scan will miss it. Compare against an authoritative roster, remove anything unrecognized, and check for accounts created on or after 22 July 2026.

3. Rotate credentials and database secrets, then kill active sessions. Rotate WordPress admin passwords, wp-config.php database credentials, API keys, and salts. Terminating sessions matters because rotation alone does not evict an attacker holding a valid session cookie. Where plaintext passwords may have been exposed, force resets across any system where those credentials could have been reused.

4. Hunt for the post-exploitation pattern, not just the initial exploit. Look for unexpected PHP files in upload directories (shell.php and variants), unfamiliar plugins, ZIP archives staged in web-accessible or temp paths, outbound connections from the web server to internal SQL hosts, and password-spray signatures in authentication logs from mid-July onward.

5. Segment the CMS from everything else. The pivot from web server to internal SQL server is the step that converted a website defacement-grade incident into a government data breach. A public-facing CMS should not have network reachability to internal database infrastructure or a credential path into it.

6. Do not stop at WordPress. The same actor hit 996 ZyXEL GS1900 switches across 48 countries. Inventory and patch exposed network appliances, management interfaces, and anything else answering on the public internet. The targeting here is opportunistic and driven by automated scanning, which means exposure, not importance, determines who gets hit.

7. Brief staff on ClickFix. Any prompt instructing a user to copy a command into PowerShell, Run, or a terminal in order to "verify you are human" is an attack. This is now the standard opening move for multiple unrelated operations.

Sources: WordPress Flaws Lead to Theft of 18,566 Gov Records & Plaintext Pas... | Open Season on Kapibala: Attacker Steals Over 18,000 ... - GreyNoise | Thousands of Hacked WordPress Sites, One Operation: Unmasking StopA... | PHP Webshell Campaign Targets WordPress Through Critical WooCommerc... | StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to ... | Hackers Exploit WordPress Flaws to Steal 18,566 Government Records... | StopAndProtect: Thousands of Hacked WordPress Sites Exposed | CVE-2026-63030: WordPress WP2Shell Hits 62,802 Attacking IPs