A single suspected Chinese-speaking threat actor spent the past four months cycling through ten unrelated pieces of software, firewalls, network switches, WordPress, code-hosting tools, a workflow engine, a lab-management system, and virtualization platforms, according to research the threat-intelligence firm GreyNoise published this week. The pattern GreyNoise traced matters less for any single flaw than for what it reveals about how opportunistic exploitation now works: broad, fast, and largely indifferent to what the target software is actually for.
A four-month tour through unrelated software
GreyNoise said it has tracked malicious use of one IP address since early June 2026, correlating activity back to at least 7 May through shared tooling, infrastructure, and operational timing. The firm assesses the actor is a suspected Chinese speaker working roughly in the UTC+8 time zone, based on the volume of Chinese-language comments in custom scripts and the timing of activity. GreyNoise also said the operator is the same as, or related to, a cluster the security vendor Acronis has separately tracked as “Red Heron,” pointing to a shared command-and-control domain and overlapping exploitation of Gitea instances.
“GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies,” the company said in its report.
Media Partner
Between 11 June and 3 September, the timeline GreyNoise reconstructed runs through PAN-OS GlobalProtect, a chained Ubiquiti UniFi OS remote-code-execution bug, the low-code platform FlowiseAI, two WordPress vulnerabilities known together as the wp2shell chain, a years-old Linux kernel privilege-escalation flaw, the Gitea code-hosting platform, the Nuclio serverless framework, Zyxel’s GS1900 line of managed switches, the SENAITE laboratory information management system, and Proxmox VE. GreyNoise said it has no evidence the actor used a specific AI coding tool, but flagged behavior in the custom scripts, near-identical revisions with only superficial changes between them, that it considers a strong indicator of large-language-model-assisted development.
The government breach hiding inside a WordPress campaign
The WordPress leg of the campaign, launched around 20 July using the wp2shell exploit chain, reached at least 49 organizations across 29 countries, mostly small businesses and government bodies. In what GreyNoise called a “red-on-red” incident, the same actor also compromised a Russian state entity operating in Russia-occupied Ukraine.
The most damaging single intrusion hit an unnamed Western government organization. Working from file-modification timestamps, GreyNoise reconstructed an intrusion that ran for roughly an hour: the actor deployed a webshell, dumped the WordPress user table to steal thirteen administrator accounts, then created a new account disguised to match the victim’s own email domain and backdated its registration date to blend into the site’s account history. From there, the actor conducted reconnaissance, attempted several publicly known Windows privilege-escalation and credential-harvesting techniques, and ultimately extracted a backend database credential, stealing more than 18,000 sensitive records. CyberTech is withholding the specific exploitation steps GreyNoise documented, consistent with this publication’s policy against republishing reproducible attack detail.
Switches, and the patch gap the campaign exposed
In mid-August the same actor turned to Zyxel’s GS1900 Smart Managed Switches, small-office network gear commonly deployed in schools, hotels, and retail locations. Using an obfuscated exploit script built for an unpatched stack-based buffer overflow (CVE-2026-7273), the actor exfiltrated configuration data, network details, and hashed root credentials from 996 switches in 48 countries, concentrated in Italy, the United States, and Taiwan. GreyNoise said 564 of the compromised devices were still running factory-default credentials.
Of the ten technologies in GreyNoise’s timeline, only one, a Linux kernel bug already patched back in 2022, was a known quantity in CISA’s Known Exploited Vulnerabilities catalog before the campaign began. Two more were added within days of their targeting becoming public, and the Zyxel flaw itself was added to KEV only this week, after GreyNoise’s disclosure, giving federal agencies until 24 September to remediate it. Four of the ten, including the flaws in FlowiseAI, Nuclio, and the SENAITE lab system, still carry no KEV entry at all, weeks or months after this single actor already used them to break in somewhere. CyberTech has reported before on the gap between when a flaw is confirmed exploited and when it reaches a mandated patch deadline; this campaign is a case study in how wide that gap can be when the affected software isn’t a headline enterprise product.
What this means for the security leader
Vulnerability triage that waits for KEV membership as its trigger for urgency will keep missing a meaningful share of live exploitation, because KEV entries lag first documented use by anywhere from days to months, and some flaws never make the list at all despite confirmed abuse. The common thread across GreyNoise’s ten targets isn’t sector, vendor, or severity score. It’s exposure: every one of them was internet-reachable and unpatched. That argues for treating asset inventory and patch cadence for every internet-facing system, not just the ones with recognizable names, as the control that actually catches this kind of campaign, since severity scoring and catalog membership will not. The apparent use of LLM-assisted tooling to iterate exploit code across such a wide range of unrelated targets, a pattern CyberTech has tracked in other recent campaigns, reinforces the same point: the next unpatched, internet-facing box an organization is running, however obscure, is now a plausible target rather than an unlikely one.
Security leaders should treat this campaign as a prompt to inventory every internet-facing appliance and self-hosted tool in their environment, not only the ones vendors and CISA have already flagged, and to patch on exposure rather than waiting for a KEV listing that may never come.
Source: GreyNoise
