Image: cdn.prod.website-files.com · rights & removal
Executive Summary
Facts Only
* GreyNoise tracks adversary activity via the Global Observation Grid (GOG).
* Activity concerning an IP address was tracked since early June 2026 due to scanning and attacks against various technologies.
* The observed activity is associated with a single malicious cyber actor (MCA) from May 7, 2026, onwards.
* The MCA is suspected to be a Chinese speaker operating in UTC+8.
* The MCA is related to "Red Heron" based on shared C2 domains, malware family, and TTPs.
* The MCA reportedly stole over 18,000 sensitive records from a western government.
* The MCA exploited CVE-2026-7273 against ZyXEL GS1900 Smart Managed Switches across 48 countries by September 17, 2026.
* Exploitation of Ubiquiti devices involved chaining vulnerabilities (CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910) for Remote Code Execution (RCE).
* WordPress exploitation used the wp2shell exploit chain (CVE-2026-63030 and CVE-2026-60137) against organizations in 29 countries.
* The intrusion into a western governmental organization resulted in the theft of sensitive records from its backend database.
* ZyXEL switches were exploited to exfiltrate information, including configurations and hashed root-level credentials.
* An exploit script for ZyXEL involved Python obfuscation with PyArmor 6.7.5.
Full Take
The narrative details a highly coordinated and sophisticated intrusion operation orchestrated by a single actor exhibiting specific linguistic and technical signatures. The shift from broad scanning to targeted exploitation of specific hardware (ZyXEL switches) and software layers (WordPress) suggests a deliberate, phased approach designed for maximum asset extraction rather than simple reconnaissance. The suspected use of a Large Language Model (LLM) in generating custom tools introduces an element of dynamic adaptability, allowing the actor to rapidly iterate on exploits, potentially bypassing static defenses by generating novel command sequences. This capability intersects critically with the post-exploitation phase, where the actor demonstrated advanced persistence and data staging capabilities, including credential harvesting from web applications and subsequent use of PowerShell and SMB spraying against internal resources. The presence of highly specific details regarding the exploitation mechanism—the Python script using PyArmor for obfuscation and the C# reflection/impersonation techniques to escalate privileges—indicates an adversary with deep, if not novel, knowledge of both system internals and modern defensive mitigations. The focus on exfiltrating credentials from government entities alongside exploiting network hardware suggests a motive centered around high-value data acquisition and persistent control over physical and digital infrastructure.
Bridge Questions: What are the systemic vulnerabilities that allow such a coordinated, multi-vector attack to proceed undetected across varied global infrastructure? How does the observed pattern of LLM-assisted coding change the traditional security model for identifying novel threat actor profiles? If the adversary successfully harvested credentials from multiple sources, what governance structures failed in preventing similar data aggregation within governmental and commercial entities?
From the original · GreyNoise Blog
GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation.Read the full story at greynoise.io
Sentinel — Likely Synthetic
The text exhibits strong patterns indicative of machine generation, particularly in its structure and the detailed enumeration of technical exploit steps, suggesting AI assistance in compiling or synthesizing complex forensic data.