OTX Threat: Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

A suspected Chinese-speaking threat actor, operating from UTC+8 timezone and linked to Red Heron, conducted extensive exploitation campaigns from May through September 2026. The adversary maintained persistent use of a single IP address to target multiple technologies including WordPress, ZyXEL switches, and various enterprise platforms. In the most severe incident, the attacker exploited WordPres CVEs: CVE-2022-0847, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-7273 Sectors: Governm