GreyNoise observed a Chinese-speaking actor linked to Red Heron exploiting WordPress, Zyxel and UniFi flaws since June 2026. Government and law-enforcement systems were targeted, with thousands of records exposed. Single-operator cross-stack activity confirms edge devices as reliable initial access. #ThreatIntel #GovSecurity #EdgeSecurity
https://cyberworldops.eu/en/one-exploit-operator-three-technology-stacks-and-thousands-of-exposed