Actor Profile

A Chinese-speaking threat actor linked to the Red Heron group has been conducting a multi-platform exploitation campaign since June 2026. The actor demonstrates sophisticated capabilities in coordinating attacks across diverse technologies including network infrastructure, web applications, and enterprise systems. Attribution is based on language indicators, infrastructure overlap, and tactical similarities to Red Heron, previously associated with exploiting the Gitea self-hosted Git service (CVE-2026-60004). The actor's motivation appears to be intelligence collection, targeting government and law enforcement entities to exfiltrate credentials, PII, and sensitive organizational data. Activity originates from consistent IP infrastructure and was detected through GreyNoise's Global Observation Grid sensor network.

TTPs (Tactics, Techniques, Procedures)

The actor employs opportunistic vulnerability exploitation as initial access (T1190 Exploit Public-Facing Application), targeting wp2shell flaws in WordPress Core (CVE-2026-63030, CVE-2026-60137), ZyXEL GS1900 switches (CVE-2026-7273), and Ubiquiti UniFi OS (CVE-2026-34908/34909/34910). Post-exploitation includes extensive reconnaissance via Command and Scripting Interpreter (T1059), querying Microsoft Defender, AMSI, services, ports, local accounts, and database configurations. Privilege escalation attempts (T1068, T1134 Access Token Manipulation) involved 17 AMSI bypass scripts and token impersonation/theft. Credential access includes extracting registry data (T1552.002) and password spraying (T1110.003) against internal SQL servers. Data exfiltration (T1041) targeted 18,566+ database records containing plaintext passwords and PII. Additional techniques include exploiting Dirty Pipe (CVE-2022-0847), FlowiseAI, Nuclio, Proxmox, PAN-OS GlobalProtect, SENAITE LIMS, and Gitea vulnerabilities.

Targets & Patterns

The campaign primarily targets government and small business sectors across 48+ countries, with emphasis on high-value Western government organizations and law enforcement agencies. Notable intrusions include an unnamed Western government entity where attackers spent 36 minutes conducting deep reconnaissance and credential theft, and a "red-on-red" compromise of a Russian state organization in occupied Ukraine. The actor demonstrates strategic targeting of critical infrastructure components—network switches (996 ZyXEL devices compromised), VPN gateways (PAN-OS GlobalProtect), and enterprise management platforms (Ubiquiti, Proxmox). Geographic distribution spans 29 countries for WordPress attacks alone, indicating broad opportunistic scanning combined with selective post-compromise activity on high-value targets. The focus on extracting government credentials, PII, and law enforcement data suggests intelligence collection objectives rather than financial motivation.

Historical Context

This activity represents an evolution of tactics associated with the Red Heron group, which previously exploited the critical Gitea vulnerability (CVE-2026-60004). The current campaign, active since early June 2026, demonstrates expanded targeting scope and technical sophistication. The actor rapidly weaponized wp2shell exploits within days of public disclosure in mid-July 2026, indicating strong exploit development or adaptation capabilities. The timeline shows progressive expansion: initial activity in June, wp2shell exploitation in July, and ZyXEL switch targeting beginning August 17, 2026. The inclusion of CISA-flagged Ubiquiti flaws (actively exploited since late June 2026) and older vulnerabilities like Dirty Pipe (CVE-2022-0847) demonstrates both opportunistic use of recent disclosures and systematic exploitation of unpatched legacy flaws. GreyNoise attributes activity through consistent IP infrastructure and behavioral patterns observed across multiple exploit chains.

Defensive Recommendations

  • Prioritize patching CVE-2026-63030, CVE-2026-60137 (WordPress wp2shell), CVE-2026-7273 (ZyXEL GS1900), CVE-2026-34908/34909/34910 (Ubiquiti UniFi OS), and CVE-2026-60004 (Gitea) across all internet-facing assets, even if not listed in CISA KEV catalog
  • Deploy enhanced logging for T1059 (Command and Scripting Interpreter) via Sysmon Event ID 1 and PowerShell ScriptBlock logging (Event ID 4104) to detect AMSI bypass attempts and reconnaissance scripts
  • Implement network segmentation to prevent lateral movement from compromised edge devices (switches, VPN gateways) to internal SQL servers; monitor for T1110.003 password spraying via failed authentication logs
  • Audit and rotate credentials for backend databases, enforce MFA for administrative access, and eliminate plaintext password storage to mitigate impact of credential theft (T1552.002)
  • Correlate GreyNoise-provided IoCs (C2 infrastructure, backdoor hashes) with network traffic and endpoint telemetry; monitor for connections to known attacker IP addresses originating from the campaign

---

# Geopolitical Context

Geopolitical Context

The campaign reflects a pattern of opportunistic exploitation by Chinese-speaking actors targeting government and law enforcement infrastructure across multiple jurisdictions. The intrusion into a Western government organization—involving extensive reconnaissance, credential theft, and exfiltration of over 18,500 records containing PII and plaintext passwords—demonstrates sophisticated tradecraft consistent with intelligence collection objectives. The "red-on-red" compromise of a Russian state entity in occupied Ukraine suggests either indiscriminate targeting based on vulnerability scanning or deliberate intelligence gathering on Russian operations in contested territory. The actor's rapid weaponization of publicly disclosed vulnerabilities (wp2shell exploits within days of public release in July 2026) and coordination across multiple platforms (WordPress, ZyXEL switches, Ubiquiti, PAN-OS) indicates a well-resourced operation with access to exploit development capabilities or close monitoring of security research communities.

State Actor Alignment

The threat actor is described as Chinese-speaking and linked by GreyNoise researchers to activity associated with the Red Heron group, previously connected to exploitation of a critical Gitea vulnerability. Attribution is based on language indicators, infrastructure overlap (attacks originating from the same IP address since June 2026), and tactical similarities to prior Red Heron operations. While no formal government attribution is provided, the targeting of government and law enforcement systems, combined with the theft of sensitive credentials and PII, is consistent with espionage objectives. The campaign does not appear to be subject to public sanctions designations at this time, though CISA has added several of the exploited vulnerabilities (notably the Ubiquiti UniFi OS flaws) to its Known Exploited Vulnerabilities catalog since late June 2026.

Business Impacty pro region

The campaign's geographic scope—affecting organizations in at least 48 countries (ZyXEL compromises) and 29 countries (WordPress intrusions)—underscores the global exposure of unpatched network infrastructure and content management systems. European government entities and critical infrastructure operators relying on affected technologies face elevated risk, particularly given the actor's demonstrated interest in Western government targets. The breach of a Russian state organization in occupied Ukraine may complicate attribution narratives and highlights the indiscriminate nature of vulnerability-based targeting, where geopolitical adversaries can become collateral victims. For NATO allies and EU member states, the incident reinforces the urgency of coordinated vulnerability disclosure and patch management, especially for edge devices (switches, VPN appliances) that often fall outside traditional endpoint security controls. The theft of law enforcement data raises concerns about operational security for international policing cooperation and cross-border investigations.

Forecast

If the threat actor maintains access to compromised infrastructure and stolen credentials, follow-on intrusions leveraging password reuse or lateral movement are likely in the near term. Organizations that have not patched CVE-2026-63030, CVE-2026-60137 (wp2shell), CVE-2026-7273 (ZyXEL), and the Ubiquiti UniFi OS vulnerabilities should anticipate continued scanning and exploitation attempts. If CISA expands its KEV catalog to include additional flaws identified by GreyNoise (e.g., CVE-2026-56271, CVE-2026-60004, CVE-2026-79756), federal agencies and critical infrastructure sectors may face mandated patching timelines, potentially straining IT resources. Should the actor's links to Red Heron be confirmed through additional technical evidence or intelligence disclosures, Western governments may issue joint advisories or impose targeted sanctions, though such measures typically lag operational exposure by months. In the medium term, the campaign's success in exploiting edge devices and open-source platforms may prompt renewed focus on supply chain security and third-party risk management in government procurement.