GreyNoise maps Kapibala campaign: 18,566 government records stolen via WordPress and Zyxel flaws

What happened

GreyNoise has published a report, dated 21 September 2026 according to a dev.to digest that surfaced it, on a campaign it tracks as Kapibala. According to GreyNoise, an attacker breached a Western government organization's database through a compromised WordPress site and made off with at least 18,566 records containing account information, plaintext passwords and personally identifiable information tied to government and law-enforcement agencies. The same actor, GreyNoise says, separately exploited CVE-2026-7273 in Zyxel GS1900 switches to steal configurations, hashed root credentials and network information from 996 devices across 48 countries. GreyNoise assesses the actor as likely Chinese-speaking and possibly the same as or related to a group it calls Red Heron, but notes the activity has not been formally attributed.

From WordPress to the internal database

GreyNoise reconstructed the first intrusion path from preserved file-modification timestamps and artifacts recovered from adversary infrastructure. The attacker compromised a public WordPress site using a chain GreyNoise labels wp2shell, which combines CVE-2026-63030 and CVE-2026-60137. From there, they deployed a custom web shell and searched the host for WordPress administrator accounts, wp-config.php and stored credentials. Those credentials were then used in a password spray against the internal SQL database, which succeeded. Custom tooling extracted and compressed the data, staging it temporarily in a web-accessible location before exfiltration. A point GreyNoise stresses for victims: this kind of breach can extend to backend credentials and databases without any clear anomaly showing up on the website frontend.

The Zyxel GS1900 side

In parallel, the actor scanned for attacker-reachable Zyxel GS1900 web management interfaces vulnerable to CVE-2026-7273, a stack-based buffer overflow in CGI handling that allows operating-system commands to run without authentication. According to GreyNoise, the attacker used the flaw to download a collector script over TFTP, harvest device data and stage it for retrieval, ultimately taking configurations, hashed root credentials and network information from 996 switches. GreyNoise notes that Zyxel describes this management interface as a LAN-based attack surface, meaning devices exposed beyond the trusted network were the practical targets. The dev.to digest also cross-references BleepingComputer reporting on both the scope of the incident and the addition of the flaw to CISA's Known Exploited Vulnerabilities catalog, suggesting CVE-2026-7273 is being exploited beyond this campaign alone.

What to look for

GreyNoise's indicators for administrators include unknown PHP files or plugins in web roots, PowerShell execution, access to the SAM, the registry or wp-config.php, a high volume of failed SMB or SQL authentication attempts followed by a successful one, and bulk retrieval of switch configurations. On the network side, it flags exploitation attempts against multiple products from the same source, heavy outbound transfers from databases, and TFTP traffic leaving switch devices. On the identity side, suspicious WordPress administrator logins, newly created accounts, modified registration timestamps and heavy internal SQL logins are the tells.

Mitigation

GreyNoise's containment guidance is straightforward: patch the targeted CVEs, remove web shells and unauthorized accounts, rotate compromised credentials, restrict Zyxel management interfaces to trusted networks and block unnecessary outbound TFTP traffic. More broadly, it recommends minimizing privileges and communication paths between the web server and the internal database, avoiding credential reuse, and continuously monitoring web roots, plugin inventories, administrator accounts and network-device configurations.

Why it matters

Two things elevate this beyond routine incident reporting. First, plaintext passwords and personally identifiable information tied to government and law-enforcement accounts are now in attacker hands, and the same stolen credentials can unlock further internal systems wherever reuse exists. Second, the campaign shows how unglamorous perimeter assets — a WordPress install and reachable switch management interfaces — can be chained into a complete path from a public website to an internal database, with nothing visibly wrong on the frontend the whole time. With CVE-2026-7273 under active exploitation and added to CISA's KEV catalog per the BleepingComputer coverage referenced in the digest, the immediate takeaway for operators is to close exposure on both CMS plugins and edge-device management planes before scanning finds it for them.