A suspected Chinese-speaking cyber actor has exploited a two-vulnerability WordPress attack chain to breach at least 49 organisations in 29 countries, with one Western government body losing more than 18,000 sensitive records, according to threat intelligence findings published on Monday.

GreyNoise said it had tracked the activity through its Global Observation Grid and linked the campaign to a single malicious cyber actor active from May, with the infrastructure under scrutiny since early June. The company said the attacker primarily struck government entities and small businesses after beginning WordPress exploitation around July 20.

The campaign used the so-called wp2shell chain, which combines CVE-2026-63030, a WordPress REST API batch-route confusion flaw, with CVE-2026-60137, an SQL injection weakness in WP_Query. Used together on vulnerable installations, the flaws can allow an unauthenticated attacker to gain database access and achieve remote code execution.

GreyNoise reconstructed the most serious intrusion from preserved file modification timestamps. It said the attacker compromised a Western government organisation on July 22, deployed a custom webshell, dumped the WordPress user table and obtained 13 administrator accounts. The intruder then created another account designed to resemble a legitimate user and altered its registration date to make it blend into the site’s history.

The attacker subsequently uploaded a custom information-gathering plugin, conducted system reconnaissance and used multiple scripts in attempts to bypass Microsoft’s Antimalware Scan Interface, escalate privileges and create a local administrator account. GreyNoise said the actor later searched readable files for plaintext credentials and obtained access details for a backend SQL database.

The theft ultimately involved 18,566 records from the government organisation, GreyNoise said. The data included sensitive information connected to government and law-enforcement users, including credentials stored in plaintext. The company did not identify the victim, citing operational and sensitivity concerns.

Within the government breach, the attacker packaged stolen files into a ZIP archive placed in a web-accessible location, downloaded source code and credentials, and then used password spraying to reach an internal SQL server. GreyNoise said two custom tools were created to extract data in bulk. The material taken from that database included account details, personally identifiable information and plaintext passwords associated with law-enforcement and government agencies. Activity at the victim continued for several hours after the initial compromise. GreyNoise cautioned that its timeline was reconstructed from file timestamps preserved on the system and could differ from findings produced by a formal forensic investigation conducted later.

Researchers assessed the actor as probably Chinese-speaking, pointing to extensive Chinese-language comments embedded in custom scripts and an operating pattern consistent with the UTC+8 time zone. GreyNoise said those indicators did not establish the actor’s nationality or sponsor and that the ultimate beneficiary of the stolen information remained unclear.

The same infrastructure and tactics showed overlap with a threat cluster identified as Red Heron, including use of a common command-and-control domain, related malware and exploitation of Gitea during July. GreyNoise stopped short of declaring the two groups identical, describing them as the same or a related actor.

WordPress disclosed fixes for the vulnerabilities on July 17. CVE-2026-63030 affects WordPress 6.9 releases before 6.9.5 and 7.0 releases before 7.0.2, while CVE-2026-60137 affects additional 6.8 versions before 6.8.6. The US Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalogue on July 21 after evidence of active exploitation emerged.

Security advisories have urged administrators to update affected WordPress installations immediately. Researchers have also warned that patched systems may still require forensic review if attackers gained access before updates were applied, because webshells, rogue administrator accounts and database theft can persist beyond the original vulnerability.

GreyNoise said the same actor had targeted other internet-facing products during the campaign, including Ubiquiti UniFi systems, Gitea, Nuclio, Proxmox and Zyxel networking equipment. It also documented exploitation of CVE-2026-7273 against Zyxel GS1900 managed switches, saying sensitive configuration data was taken from 996 devices across 48 countries.

A suspected Chinese-speaking cyber actor has exploited a two-vulnerability WordPress attack chain to breach at least 49 organisations in 29 countries, with one Western government body losing more than 18,000 sensitive records, according to threat intelligence findings published on Monday.

GreyNoise said it had tracked the activity through its Global Observation Grid and linked the campaign to a single malicious cyber actor active from May, with the infrastructure under scrutiny since early June. The company said the attacker primarily struck government entities and small businesses after beginning WordPress exploitation around July 20.

The campaign used the so-called wp2shell chain, which combines CVE-2026-63030, a WordPress REST API batch-route confusion flaw, with CVE-2026-60137, an SQL injection weakness in WP_Query. Used together on vulnerable installations, the flaws can allow an unauthenticated attacker to gain database access and achieve remote code execution.

GreyNoise reconstructed the most serious intrusion from preserved file modification timestamps. It said the attacker compromised a Western government organisation on July 22, deployed a custom webshell, dumped the WordPress user table and obtained 13 administrator accounts. The intruder then created another account designed to resemble a legitimate user and altered its registration date to make it blend into the site’s history.

The attacker subsequently uploaded a custom information-gathering plugin, conducted system reconnaissance and used multiple scripts in attempts to bypass Microsoft’s Antimalware Scan Interface, escalate privileges and create a local administrator account. GreyNoise said the actor later searched readable files for plaintext credentials and obtained access details for a backend SQL database.

The theft ultimately involved 18,566 records from the government organisation, GreyNoise said. The data included sensitive information connected to government and law-enforcement users, including credentials stored in plaintext. The company did not identify the victim, citing operational and sensitivity concerns.

Within the government breach, the attacker packaged stolen files into a ZIP archive placed in a web-accessible location, downloaded source code and credentials, and then used password spraying to reach an internal SQL server. GreyNoise said two custom tools were created to extract data in bulk. The material taken from that database included account details, personally identifiable information and plaintext passwords associated with law-enforcement and government agencies. Activity at the victim continued for several hours after the initial compromise. GreyNoise cautioned that its timeline was reconstructed from file timestamps preserved on the system and could differ from findings produced by a formal forensic investigation conducted later.

Researchers assessed the actor as probably Chinese-speaking, pointing to extensive Chinese-language comments embedded in custom scripts and an operating pattern consistent with the UTC+8 time zone. GreyNoise said those indicators did not establish the actor’s nationality or sponsor and that the ultimate beneficiary of the stolen information remained unclear.

The same infrastructure and tactics showed overlap with a threat cluster identified as Red Heron, including use of a common command-and-control domain, related malware and exploitation of Gitea during July. GreyNoise stopped short of declaring the two groups identical, describing them as the same or a related actor.

WordPress disclosed fixes for the vulnerabilities on July 17. CVE-2026-63030 affects WordPress 6.9 releases before 6.9.5 and 7.0 releases before 7.0.2, while CVE-2026-60137 affects additional 6.8 versions before 6.8.6. The US Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalogue on July 21 after evidence of active exploitation emerged.

Security advisories have urged administrators to update affected WordPress installations immediately. Researchers have also warned that patched systems may still require forensic review if attackers gained access before updates were applied, because webshells, rogue administrator accounts and database theft can persist beyond the original vulnerability.

GreyNoise said the same actor had targeted other internet-facing products during the campaign, including Ubiquiti UniFi systems, Gitea, Nuclio, Proxmox and Zyxel networking equipment. It also documented exploitation of CVE-2026-7273 against Zyxel GS1900 managed switches, saying sensitive configuration data was taken from 996 devices across 48 countries.