GreyNoise ties 18,566 stolen government records and 996 harvested Zyxel switches to one actor

The WordPress side ran in five steps, and only the first one needed a vulnerability. GreyNoise says the actor chained CVE-2026-63030 and CVE-2026-60137, the pair it calls wp2shell, to get code running on a public site ^[4]. A custom web shell followed, then a local hunt for administrator accounts, wp-config.php and any other credentials sitting on the host ^[5]. Those credentials were sprayed against the internal SQL database until one of them authenticated ^[6]. The data was compressed with custom tooling and parked in a web-accessible directory for retrieval ^[7]. The stolen records included plaintext passwords and personally identifiable information ^[2].

Steps two through five come down to configuration. The report's own preconditions say the WordPress host could read credential-containing files, and that the stolen credentials were valid for internal SQL authentication ^[20]. Patching the two CMS bugs closes step one. For the rest, the recommended controls are privilege and path minimisation between the web server and the database, and not reusing credentials across them ^[14].

Zyxel's path is shorter. CVE-2026-7273 is a stack-based buffer overflow in a CGI handler that executes OS commands without authentication, so the actor ran a command, pulled a collector script over TFTP, and staged the output on the device for pickup ^[8]. Spread across 48 countries, 996 devices averages about 21 per country ^[19]. The precondition GreyNoise lists for that half of the campaign is reachability of the GS1900 web management interface, which Zyxel describes as a LAN-based attack surface ^[9]. On these 996 devices, it was reachable from the internet.

GreyNoise describes the switch exploitation as a separate operation by the same actor, not a stage of the WordPress intrusion ^[11]. The report does not show the harvested switch data being used to reach the government network. So the two backlogs do not collapse into one incident; what overlaps is the indicator set, because both operations ran from shared external hosts ^[10]. A blocklist built from one covers the other. The remediation work splits in two: privilege separation between a web server and a database on one side, taking a switch management page off the reachable internet on the other ^[14].

The indicator list is ordinary: unknown PHP files or plugins, PowerShell execution, access to SAM, the registry or wp-config.php, a run of failed SMB and SQL authentication attempts followed by a success, and bulk retrieval of Zyxel configurations ^[13]. The site frontend stays normal throughout ^[15]. On the initial intrusion, GreyNoise says there is no public evidence that email was used ^[16]. It rates the incident critical in a writeup dated 21 September 2026 ^[17], and says the Kapibala actor is the same as or related to Red Heron without formally attributing it ^[12].