Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
Source AlienVault OTX General
United States
Albania
Australia
Austria
Belarus
Belgium
Brazil
Bulgaria
Chile
China
Colombia
Costa Rica
Czechia
Denmark
Estonia
Finland
France
Germany
Greece
Guadeloupe
Hong Kong
Hungary
Iceland
India
Ireland
Italy
Japan
Latvia
Lithuania
Madagascar
Malaysia
Malta
Martinique
Monaco
Mongolia
Netherlands
Norway
Pakistan
Panama
Philippines
Poland
Portugal
Romania
Russia
Slovakia
Slovenia
South Africa
Spain
Sweden
Switzerland
Taiwan
Thailand
Ukraine
United Arab Emirates
Uzbekistan- government breach
- kapibala
- zyxel switches
- privilege escalation
- data exfiltration
- chinese-speaking actor
- wordpress exploitation
Mentions 3 CVEs
Mentioned vulnerabilities
Description
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
Impact
The breach resulted in the theft of over 18,000 sensitive government records containing credentials and personally identifiable information, which could facilitate further attacks or identity theft. The compromise of 996 ZyXEL GS1900 switches across 48 countries exposed network device configurations and credentials, potentially enabling persistent network access or lateral movement. The attacker’s use of privilege escalation and custom tools indicates a high level of sophistication, increasing the risk of prolonged undetected access and further exploitation.
Defensive guidance
Patch status is not yet confirmed — check the vendor advisories for CVE-2026-63030, CVE-2026-60137 (WordPress), and CVE-2026-7273 (ZyXEL GS1900 switches) for current remediation guidance. Organizations should apply official security updates for these vulnerabilities as soon as they become available. Monitoring for indicators of compromise related to this campaign, such as the identified hashes and domains, is recommended. Given the actor’s use of PowerShell-based exfiltration, restricting or monitoring PowerShell usage may help detect or mitigate ongoing attacks. No vendor advisories or patch links were provided in the input data.
MITRE ATT&CK techniques
- T1190Exploit Public-Facing Application · Initial Access (opens in a new tab)
- T1078Valid Accounts · Stealth, Persistence, Privilege Escalation, Initial Access (opens in a new tab)
- T1059.001Command and Scripting Interpreter: PowerShell · Execution (opens in a new tab)
- T1136.001Create Account: Local Account · Persistence (opens in a new tab)
- T1505.003Server Software Component: Web Shell · Persistence (opens in a new tab)
Indicators of compromise
Domains 1
- p3.981666.xyz
Hashes 3
CVEs 12
- CVE-2022-0847
- CVE-2026-34908
- CVE-2026-34909
- CVE-2026-34910
- CVE-2026-7273
- CVE-2026-63030
- CVE-2026-60137
- CVE-2026-60004
- CVE-2023-54391
- CVE-2026-54569