As reported by BleepingComputer, GreyNoise has uncovered a sustained campaign by a Chinese-speaking threat actor — linked to the Red Heron group — that chains multiple known vulnerabilities across WordPress, Zyxel, PAN-OS, FlowiseAI, Nuclio, Proxmox, and Ubiquiti to exfiltrate sensitive government and law-enforcement data. The campaign is a textbook example of how adversaries weaponize public exploit code within days of release and move laterally through heterogeneous infrastructure with alarming speed.
Why This Matters
The most striking detail from GreyNoise's findings is the 36-minute window at a Western government target. In that brief span, the attacker executed 17 scripts to bypass AMSI, perform token impersonation for privilege escalation, create a local administrator, harvest registry data, and ultimately reach a backend SQL server containing plaintext passwords and PII. This is not opportunistic scanning — it is a rapid, rehearsed post-exploitation playbook that assumes initial access is already achieved.
The campaign also demonstrates a shift in targeting breadth. Rather than focusing on a single technology stack, the actor is exploiting any exposed, unpatched edge device or web application across the target's environment. This multi-vector approach means that patching one vulnerability is insufficient — defenders must assess their entire external attack surface.
Vulnerability Details
| CVE | Product | Severity | Patch Status | Active Exploitation |
|---|---|---|---|---|
| CVE-2026-63030 | WordPress Core (wp2shell) | Critical | Update to latest WordPress version | Yes — observed since mid-July 2026 |
| CVE-2026-60137 | WordPress Core (wp2shell) | Critical | Update to latest WordPress version | Yes — chained with CVE-2026-63030 |
| CVE-2026-7273 | Zyxel GS1900 Smart Managed Switches | High | Check Zyxel security advisories for firmware update | Yes — since August 17, 2026; 996 devices compromised |
The wp2shell exploits became public in mid-July 2026 and were weaponized within days. Any organization running an unpatched WordPress instance exposed to the internet remains at immediate risk.
Who Is at Risk
Broader Implications
The presence of a “red-on-red” compromise — the actor breaching a Russian state organization in occupied Ukraine — signals that this group operates without traditional geopolitical restraint and is willing to target anyone with exposed vulnerabilities. It also suggests the actor is scanning broadly and exploiting whatever they find, rather than maintaining a narrow target list.
The theft of plaintext passwords from backend databases is particularly damaging. These credentials enable follow-on access that persists well beyond the initial vulnerability window, meaning that even patched systems may remain compromised if credential rotation did not occur.
Shield53 Recommendations
Immediate Actions
- Patch WordPress immediately to the latest version if running any release prior to the wp2shell fix. Verify that all plugins and themes are also current.
- Update Zyxel GS1900 firmware and disable remote management on all network switch interfaces. Restrict management access to a dedicated VLAN or VPN-only path.
- Audit WordPress backend databases for evidence of unauthorized queries or data exfiltration. Look for anomalous SQL connections from non-application hosts.
- Rotate all credentials stored in any database that may have been accessible through WordPress, including application service accounts, database users, and any stored user passwords.
- Hunt for AMSI bypass artifacts — review Windows Event Logs for suspicious PowerShell activity, token manipulation, and local administrator creation events, especially on web-facing servers.
- Deploy WAF rules blocking known wp2shell exploit signatures if patching cannot be completed immediately.
Strategic Actions
- Conduct a full external attack surface review covering all internet-exposed devices — not just WordPress and Zyxel — including FlowiseAI, Nuclio, Proxmox, and Ubiquiti deployments.
- Implement network segmentation so that web application servers cannot directly reach backend database servers without an intermediary layer that enforces authentication and logging.
- Enable enhanced logging on all edge devices and forward to a SIEM for correlation. The GreyNoise timeline shows that every step of this attack was loggable — defenders need to be looking.
- Subscribe to threat intelligence feeds that track exploit code publication timelines, so patching SLAs can be compressed when public PoCs appear.
