GreyNoise exploitation timeline: what should defenders re-evaluate now?

TL;DR: A suspected single malicious actor has scanned and exploited multiple technologies since May 2026, including WordPress, Gitea and ZyXEL devices, while also stealing more than 18,000 records from a western government and exfiltrating data from 996 switches across 48 countries, according to GreyNoise. The pattern shows that broad opportunistic scanning can still produce repeatable, high-impact compromise when exposed services, weak credentials and post-exploitation collection are left unchecked.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation”.

By the numbers:

• GreyNoise reports successful exploitation of 996 ZyXEL GS1900 switches across 48 countries.
• GreyNoise says at least 49 organizations across 29 countries were affected by the WordPress wp2shell chain.
• GreyNoise notes that 564 of the 996 ZyXEL victims had factory default credentials.

Key questions

Q: What breaks when exposed services are exploitable and credentials are still reusable?

A: The attacker does not need a single perfect exploit path.

Q: Why do default credentials and rooted device access create outsized risk?

A: Default access collapses the attacker’s work from discovery into immediate control.

Q: What signs indicate an intrusion has moved from exploitation to collection?

A: Look for dumped admin accounts, masquerading user creation, webshell-driven reconnaissance, local ZIP staging, unusual PowerShell or script activity, and outbound retrieval from temporary paths.

Practitioner guidance

• Map internet-facing assets to live exposure Compare external scanning results with current patch and service inventories so that reachable WordPress, switch and management interfaces are validated against actual exploitability.
• Hunt for webshells and staging paths Look for unusual downloads, local archive creation, web-reachable temporary files and remote collector activity that indicate the attacker has moved beyond the initial exploit.
• Revoke and rotate exposed credentials Treat admin tables, readable config files, device root credentials and backend database secrets as incident-grade exposure if they appear in compromised systems.

Bottom line: This campaign shows that exploitation rarely stays at the perimeter once attackers can reuse credentials, webshells or default device access.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →