GreyNoise links WordPress, Zyxel intrusions to data theft

GreyNoise said it found the activity on its Global Observation Grid and linked it to a threat actor associated with the Red Heron group. The researchers said the actor used wp2shell flaws in WordPress Core to reach at least 49 organisations across 29 countries.

Public exploit code appeared in mid-July 2026, and GreyNoise said the campaign started soon afterwards. The researchers said the operator focused on higher-value targets, including one unnamed western government organisation.

In that intrusion, the attacker used a custom wp2shell exploit and then checked Windows security controls, services, listening ports, local accounts, application restrictions and database settings. GreyNoise said the actor spent 36 minutes trying 17 scripts to evade AMSI, raise privileges, create a local administrator and read registry data.

After finding credentials for a backend SQL database, the attacker used password spraying to reach an internal SQL server and took at least 18,566 records. GreyNoise said those records included accounts, plaintext passwords and personal information tied to government and law-enforcement bodies. It also said the same attacker compromised a Russian state organisation in occupied Ukraine.

On 17 August, the same threat actor exploited CVE-2026-7273 in ZyXEL GS1900 Smart Managed Switches and compromised 996 devices in 48 countries to take configurations, network details and hashed root credentials. GreyNoise also said it saw attempts against Ubiquiti UniFi OS, PAN-OS GlobalProtect, FlowiseAI, Dirty Pipe, Gitea, Nuclio, SENAITE LIMS and Proxmox VE, while CISA had already marked the three Ubiquiti issues as actively exploited.