Red Heron-linked actor turned mid-July wp2shell exploits into 18,566 stolen government records

The Western government intrusion has the fullest record. The actor arrived with a custom wp2shell exploit, then checked Microsoft Defender, AMSI, available services, listening ports, local accounts, application restrictions and database configuration ^[8]. Over 36 minutes it ran 17 scripts to bypass AMSI, escalate through token impersonation or theft, create a local administrator and extract registry data ^[9], about one script every two minutes ^[19].

After locating credentials for a backend SQL database, the actor sprayed them against an internal SQL server and got in ^[10]. What came out included accounts, plaintext passwords and personally identifiable information connected to government and law-enforcement agencies ^[11].

Against the switches, the campaign went wider and shallower. GreyNoise dates the CVE-2026-7273 exploitation to August 17, roughly a month after the wp2shell campaign began ^[21], and the extraction from the GS1900 units covered configurations, network information and hashed root-level credentials ^[13]. The report does not include a disclosure or patch date for the ZyXEL flaw ^[22], so the days-from-PoC pattern is documented for WordPress Core ^[6] alone.

Vintage is the other thing to read off the target list. Alongside the 2026 bugs, GreyNoise confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569), Proxmox VE (CVE-2023-54391) and the Linux kernel's Dirty Pipe, CVE-2022-0847 ^[16]. Dirty Pipe is four years older than the WordPress flaws being worked in the same campaign ^[20]. The actor also tried to chain three Ubiquiti UniFi OS flaws, CVE-2026-34908, CVE-2026-34909 and CVE-2026-34910, for root-level remote code execution ^[14]; CISA has listed those three as actively exploited since late June 2026 ^[15]. GreyNoise says not all the vulnerabilities in this cluster have been added to the Known Exploited Vulnerabilities catalog ^[17].

One victim sits outside the government-and-small-business pattern: a Russian state organization in occupied Ukraine, which the researchers described as a "red-on-red" compromise ^[12].

The scans and the exploit attempts come from the same IP address, observed since early June 2026, and GreyNoise ties that activity to a threat actor related to Red Heron, a group previously linked to exploiting a critical flaw in the self-hosted Git service Gitea ^[2][3]. The detection came through the company's Global Observation Grid sensor network ^[4]. GreyNoise has published indicators of compromise for the activity, including backdoor hashes and command-and-control infrastructure ^[18].