WordPress Exploitation and Data Exfiltration by Red Heron Affiliate

GreyNoise has identified a cyber actor associated with the "Red Heron" group exploiting a range of edge technologies since mid-2026. The actor leverages custom tools, suspected to be generated via large language models (LLMs), to perform rapid, multi-stage attacks. The primary objective observed is the theft of sensitive data, culminating in the exfiltration of over 18,000 records from a western government entity. The actor demonstrates sophistication in blending into target environments, such as backdating illegitimate administrative accounts and utilizing custom WordPress plugins for environment enumeration. Key targeted technologies include WordPress (CVE-2026-63030, CVE-2026-60137), Ubiquiti UniFi OS (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), and ZyXEL GS1900 switches (CVE-2026-7273). The actor's tradecraft involves staging backdoors on compromised infrastructure and using AMSI-bypass techniques on Windows hosts to maintain persistence and escalate privileges.

Attack Chain

1. Initial Access: Adversary uses a custom exploit chain (CVE-2026-63030 and CVE-2026-60137) to gain unauthenticated access to WordPress installations.
2. Persistence: Attacker creates a new administrative user, masquerading as a legitimate email address, and modifies metadata to blend into site history.
3. Reconnaissance: Attacker uploads a custom information collection plugin to enumerate the WordPress database and filesystem.
4. Tooling: Webshells are deployed to conduct command execution, enabling the adversary to run reconnaissance commands such as net user and appcmd.exe list site.
5. Evasion: Attacker utilizes custom scripts to attempt bypasses of Microsoft Antimalware Scan Interface (AMSI) and checks for installed security products.
6. Exfiltration: Attacker queries database configuration files (wp-config.php) to extract credentials and subsequently dumps sensitive backend database records.

Impact

The campaign has impacted at least 49 organizations across 29 countries, primarily targeting small business and governmental sectors. Notably, 996 ZyXEL switches were compromised globally, and over 18,000 sensitive government records were stolen from a single western governmental organization.

Recommendation

• Patch WordPress installations against CVE-2026-63030 and CVE-2026-60137 immediately.
• Audit WordPress administrator accounts for suspicious entries, specifically focusing on account creation dates that do not match the expected user lifecycle.
• Search for unauthorized account additions and custom plugins uploaded to wp-content/plugins/ directories.
• Monitor network traffic for connections to the C2 domain p3.981666.xyz and the staging server 74.48.66.73.
• Deploy Sigma rules to detect suspicious powershell and cmd execution patterns observed in the brief, specifically commands querying wp-config.php or Get-MpComputerStatus.