{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/red-heron/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Red Heron"],"_cs_cpes":["cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*","cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_machine_special_edition_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_machine_pro_max_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:enterprise_fortress_gateway_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_wall_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_router_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_router_7_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_express_7_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_network_video_recorder_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_network_video_recorder_pro_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_network_video_recorder_instant_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:enterprise_network_video_recorder_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_cloud_gateway_ultra_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_cloud_gateway_max_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_cloud_gateway_fiber_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:unifi_dream_router_5g_max_firmware:*:*:*:*:*:*:*:*","cpe:2.3:o:ui:enterprise_network_video_recorder_core_firmware:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-63030"},{"cvss":5.9,"id":"CVE-2026-60137"},{"cvss":10,"id":"CVE-2026-34908"},{"cvss":10,"id":"CVE-2026-34909"},{"cvss":10,"id":"CVE-2026-34910"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WordPress (\u003c latest patched version)","UniFi OS","GS1900 Smart Managed Switches"],"_cs_severities":["high"],"_cs_tags":["wordpress","data-theft","exfiltration","vulnerability-exploitation"],"_cs_type":"threat","_cs_vendors":["WordPress","Ubiquiti","ZyXEL"],"content_html":"\u003cp\u003eGreyNoise has identified a cyber actor associated with the \u0026quot;Red Heron\u0026quot; group exploiting a range of edge technologies since mid-2026. The actor leverages custom tools, suspected to be generated via large language models (LLMs), to perform rapid, multi-stage attacks. The primary objective observed is the theft of sensitive data, culminating in the exfiltration of over 18,000 records from a western government entity. The actor demonstrates sophistication in blending into target environments, such as backdating illegitimate administrative accounts and utilizing custom WordPress plugins for environment enumeration. Key targeted technologies include WordPress (CVE-2026-63030, CVE-2026-60137), Ubiquiti UniFi OS (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), and ZyXEL GS1900 switches (CVE-2026-7273). The actor's tradecraft involves staging backdoors on compromised infrastructure and using AMSI-bypass techniques on Windows hosts to maintain persistence and escalate privileges.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: Adversary uses a custom exploit chain (CVE-2026-63030 and CVE-2026-60137) to gain unauthenticated access to WordPress installations.\u003c/li\u003e\n\u003cli\u003ePersistence: Attacker creates a new administrative user, masquerading as a legitimate email address, and modifies metadata to blend into site history.\u003c/li\u003e\n\u003cli\u003eReconnaissance: Attacker uploads a custom information collection plugin to enumerate the WordPress database and filesystem.\u003c/li\u003e\n\u003cli\u003eTooling: Webshells are deployed to conduct command execution, enabling the adversary to run reconnaissance commands such as \u003ccode\u003enet user\u003c/code\u003e and \u003ccode\u003eappcmd.exe list site\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEvasion: Attacker utilizes custom scripts to attempt bypasses of Microsoft Antimalware Scan Interface (AMSI) and checks for installed security products.\u003c/li\u003e\n\u003cli\u003eExfiltration: Attacker queries database configuration files (\u003ccode\u003ewp-config.php\u003c/code\u003e) to extract credentials and subsequently dumps sensitive backend database records.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe campaign has impacted at least 49 organizations across 29 countries, primarily targeting small business and governmental sectors. Notably, 996 ZyXEL switches were compromised globally, and over 18,000 sensitive government records were stolen from a single western governmental organization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch WordPress installations against CVE-2026-63030 and CVE-2026-60137 immediately.\u003c/li\u003e\n\u003cli\u003eAudit WordPress administrator accounts for suspicious entries, specifically focusing on account creation dates that do not match the expected user lifecycle.\u003c/li\u003e\n\u003cli\u003eSearch for unauthorized account additions and custom plugins uploaded to \u003ccode\u003ewp-content/plugins/\u003c/code\u003e directories.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for connections to the C2 domain \u003ccode\u003ep3.981666.xyz\u003c/code\u003e and the staging server \u003ccode\u003e74.48.66.73\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy Sigma rules to detect suspicious \u003ccode\u003epowershell\u003c/code\u003e and \u003ccode\u003ecmd\u003c/code\u003e execution patterns observed in the brief, specifically commands querying \u003ccode\u003ewp-config.php\u003c/code\u003e or \u003ccode\u003eGet-MpComputerStatus\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-21T13:50:29Z","date_published":"2026-09-21T13:50:29Z","id":"https://feed.craftedsignal.io/briefs/2026-09-kapibala-wordpress-exploitation/","summary":"An adversary linked to the Red Heron group is exploiting multiple vulnerabilities in WordPress, Ubiquiti, and ZyXEL devices to conduct reconnaissance, gain persistence, and exfiltrate sensitive records, including over 18,000 government documents.","title":"WordPress Exploitation and Data Exfiltration by Red Heron Affiliate","url":"https://feed.craftedsignal.io/briefs/2026-09-kapibala-wordpress-exploitation/"}],"language":"en","title":"CraftedSignal Threat Feed - Red Heron","version":"https://jsonfeed.org/version/1.1"}