← threat actors
threat actor · not yet in the cluster map
red-heron
2 stories · 2 in the wild · September 15, 2026 – September 23, 2026
evidence: 2 observed
sectors
- government 1 · Sep 23
- technology 1 · Sep 15
geography
- china 1 · Sep 15
- taiwan 1 · Sep 15
malware and tools
- jitterly 1 · Sep 15
- sixzut 1 · Sep 15
techniques
- amsi bypass 1 · Sep 23
- credential theft 1 · Sep 23
- impersonation 1 · Sep 23
- password spray 1 · Sep 23
- exploitation 1 · Sep 15
attack phases seen
- Initial access 2 · Sep 23
- Credential access 1 · Sep 23
- Discovery 1 · Sep 23
- Lateral movement 1 · Sep 23
- Execution 1 · Sep 15
- Persistence 1 · Sep 15
- Privilege escalation 1 · Sep 15
what we reported, newest first, grouped by story
September 23, 2026
- A Chinese-speaking actor tied to Red Heron has pulled configs and hashed root credentials from 996 Zyxel GS1900 switches in 48 countries since 17 August via CVE-2026-7273, now in KEV. The same operator used the wp2shell WordPress bugs (CVE-2026-63030, CVE-2026-60137) against at least 49 organizations in 29 countries; in one Western government intrusion GreyNoise logged 17 scripts over 36 minutes attempting AMSI bypass, token impersonation and local admin creation, followed by a password spray that yielded 18,566 records including plaintext passwords. A Russian state organization in occupied Ukraine was also hit (BleepingComputer, SecurityWeek).
· Sep 23 · observed · Exploited in the Wild
Jul 30 – September 15, 2026
- Red Heron industrialized a public Gitea PoC within days. Acronis TRU assesses the cluster as China-linked with moderate confidence and says it began abusing CVE-2026-60004 on July 29. It scanned 1,386 instances across seven countries, kept a separate dataset of 477 Taiwan systems, and confirmed 13 organizational compromises in six countries. Activity reached root on a three-node Proxmox cluster and deployed JITTERLY plus the SIXZUT
LD_PRELOAD rootkit.
· Sep 15 · observed · Exploitation & Vulnerability Research