Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

Reported 22 Sep 2026 by otx · Severity: medium

A suspected Chinese-speaking threat actor, operating from UTC+8 timezone and linked to Red Heron, conducted extensive exploitation campaigns from May through September 2026. The adversary maintained persistent use of a single IP address to target multiple technologies including W