INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

| 2026-09-22 11:40 CRITICAL MEDIUM EXPLOITED VULNERABILITY STATE-SPONSORED & ESPIONAGE CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
On September 23, 2026, a Chinese-speaking threat actor exploited vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from at least 996 devices and over 18,500 records stored in backend databases. The adversary targeted multiple technologies, including PAN-OS Global Protect, FlowiseAI, Nuclio, Proxmox, Ubiquity, with exploits for known security issues. This attack was detected by GreyNoise through its Global Observation Grid (GOG) network of sensors and is attributed to a threat actor related to the Red Heron group. The attackers used custom exploits to breach at least 49 organizations in 29 countries, including one unnamed Western government organization, where they stole over 18,566 records containing accounts, plaintext passwords, and personally identifiable information.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-63030, CVE-2026-60137 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • User Training (ATT&CK mitigation for Impersonation): Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in- • Threat Intelligence Program (ATT&CK mitigation for Impersonation): Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 9 IoCs Create Free Account
hxxp://••••••••••••••••••••
2ff294••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
0e81d8••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
0f6e75••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
98•••••.xyz
ww•••••.io
p3•••••.xyz
104.225.•••.•••
172.245.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-63030CVE-2026-63030 CVE-2026-60137CVE-2026-60137 CVE-2026-56271CVE-2026-56271 CVE-2026-60004CVE-2026-60004 CVE-2026-34909CVE-2026-34909 CVE-2026-79756CVE-2026-79756 CVE-2023-54391CVE-2023-54391 CVE-2026-7273CVE-2026-7273 CVE-2022-0847CVE-2022-0847 CVE-2026-54569CVE-2026-54569 CVE-2026-34910CVE-2026-34910 CVE-2026-34908CVE-2026-34908
Target & Sectors
NORTH_AMERICA NORTH_AMERICA SOUTH_ASIA SOUTH_ASIA CENTRAL_ASIA CENTRAL_ASIA NORDICS NORDICS LATAM LATAM ASEAN ASEAN DACH DACH BENELUX BENELUX governmentgovernment
Incident Timeline
‎early June 2026
Threat actors related to the Red Heron group exploited a critical flaw in the Gitea self-hosted Git service, using an IP address linked to malicious scans and attacks since early June 2026.
organisation IP
GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies.
Scans and attacks attributed to the adversary originate from the same IP address and have been recorded since early June 2026, and have been attributed to a threat actor related to the Red Heron group, linked to exploiting a critical flaw in the Gitea self-hosted Git service.
organisation Red Heron
Scans and attacks attributed to the adversary originate from the same IP address and have been recorded since early June 2026, and have been attributed to a threat actor related to the Red Heron group, linked to exploiting a critical flaw in the Gitea self-hosted Git service.
‎late June 2026
Threat actors exploited three actively exploited Ubiquiti flaws to target a WordPress site, resulting in the theft of over 18,000 government records.
‎August 17
Threat actors exploited multiple flaws, including a high-severity flaw in ZyXEL GS1900 Smart Managed Switches (CVE-2026-7273), to target 996 devices across 48 countries.
vulnerability CVE-2026-7273
Exploiting multiple flaws On August 17, the threat actor started to exploit a high-severity flaw (CVE-2026-7273) in ZyXEL GS1900 Smart Managed Switches and compromised 996 devives in 48 countries to extract device configurations, network information, and hashed root-level credentials.
general_metric 48 countries
Exploiting multiple flaws On August 17, the threat actor started to exploit a high-severity flaw (CVE-2026-7273) in ZyXEL GS1900 Smart Managed Switches and compromised 996 devives in 48 countries to extract device configurations, network information, and hashed root-level credentials.
general_metric 996 devives
Exploiting multiple flaws On August 17, the threat actor started to exploit a high-severity flaw (CVE-2026-7273) in ZyXEL GS1900 Smart Managed Switches and compromised 996 devives in 48 countries to extract device configurations, network information, and hashed root-level credentials.
‎May through September 2026
A suspected Chinese-speaking threat actor, linked to Red Heron, exploited WordPress vulnerabilities from May through September 2026.
organisation Red Heron
A suspected Chinese-speaking threat actor, operating from UTC+8 timezone and linked to Red Heron, conducted extensive exploitation campaigns from May through September 2026.
‎2026/09/22
A Chinese-speaking threat actor exploited vulnerabilities in WordPress and other systems to steal over 18,000 government records.
organisation WordPress Core
According to the researchers, the threat actor leveraged the wp2shell vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in the WordPress Core component to breach at least 49 organizations in 29 countries.
victims 49 organizations
According to the researchers, the threat actor leveraged the wp2shell vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in the WordPress Core component to breach at least 49 organizations in 29 countries.
organisation CVE-2026
Timeline of exploitation activity Source: GreyNoise Additionally, the hackers attempted to chain the Ubiquiti UniFi OS vulnerabilities tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 to obtain root-level remote code execution.
organisation UniFi
Timeline of exploitation activity Source: GreyNoise Additionally, the hackers attempted to chain the Ubiquiti UniFi OS vulnerabilities tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 to obtain root-level remote code execution.
data_breach 18,000 sensitive records
Over 18,000 Government Records Through WordPress Exploitation.
infrastructure 996 devices
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.
organisation ZyXEL GS1900 Smart Managed Switches
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.
data_breach 18,500 records
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.
organisation WordPress
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data.
organisation Zyxel
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data.
organisation GreyNoise
GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control.
The campaign GreyNoise observed started around the same time, targeting high-value entities.
organisation GOG
GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control.
infrastructure Windows
The attacker used a custom wp2shell exploit and performed extensive Windows and security reconnaissance, checking Microsoft Defender, AMSI, available services, listening ports, local accounts, application restrictions, and database configuration.
organisation Microsoft Defender
The attacker used a custom wp2shell exploit and performed extensive Windows and security reconnaissance, checking Microsoft Defender, AMSI, available services, listening ports, local accounts, application restrictions, and database configuration.
organisation AMSI
The attacker used a custom wp2shell exploit and performed extensive Windows and security reconnaissance, checking Microsoft Defender, AMSI, available services, listening ports, local accounts, application restrictions, and database configuration.
infrastructure 17 scripts
Over 36 minutes, the threat actor tried 17 scripts to bypass AMSI, escalate privileges through token impersonation or theft, create a local administrator, and extract registry data, GreyNoise says .
organisation CVE-2022-0847
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
organisation CVE-2023-54391
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
infrastructure Linux
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
organisation PAN-OS GlobalProtect
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
organisation Gitea
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
organisation SENAITE LIMS
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
infrastructure 0847 Pipe flaw
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
organisation PAN-OS Global Protect
The adversary targeted multiple technologies, including PAN-OS Global Protect, FlowiseAI, Nuclio, Proxmox, Ubiquity, with exploits for known security issues.
organisation SQL
After locating credentials for a backend SQL database, the attackers used them in a password-spraying attack that gave them access to an internal SQL server, from which they stole at least 18,566 records.
data_breach 18,566 records
After locating credentials for a backend SQL database, the attackers used them in a password-spraying attack that gave them access to an internal SQL server, from which they stole at least 18,566 records.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
‎September 2026
The attacker exploited multiple vulnerabilities, including CVE-2026-7273 in ZyXEL switches and WordPress vulnerabilities CVE-2026-63030 and CVE-2026-60137, to steal over 18,000 sensitive government records.
organisation CVE-2026
In the most severe incident, the attacker exploited WordPress vulnerabilities CVE-2026-63030 and CVE-2026-60137 to breach a western government organization, stealing over 18,000 sensitive records containing credentials and personally identifiable information.
data_breach 18,000 sensitive records
In the most severe incident, the attacker exploited WordPress vulnerabilities CVE-2026-63030 and CVE-2026-60137 to breach a western government organization, stealing over 18,000 sensitive records containing credentials and personally identifiable information.
infrastructure 996 devices
Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials.
organisation IP
The adversary maintained persistent use of a single IP address to target multiple technologies including WordPress, ZyXEL switches, and various enterprise platforms.
organisation WordPress
The adversary maintained persistent use of a single IP address to target multiple technologies including WordPress, ZyXEL switches, and various enterprise platforms.
Tactical Metrics
Metrics
data_breach
18,000
Sensitive Records
In the most severe incident, the attacker exploited WordPress vulnerabilities CVE-2026-63030 and CVE-2026-60137 to breach a western government organization, stealing over 18,000 sensitive records containing credentials and personally identifiable information.
Over 18,000 Government Records Through WordPress Exploitation.
Metrics
infrastructure
996
Devices
Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials.
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.
Metrics
infrastructure
‎Windows
Affected Product
The attacker used a custom wp2shell exploit and performed extensive Windows and security reconnaissance, checking Microsoft Defender, AMSI, available services, listening ports, local accounts, application restrictions, and database configuration.
Metrics
infrastructure
17
Scripts
Over 36 minutes, the threat actor tried 17 scripts to bypass AMSI, escalate privileges through token impersonation or theft, create a local administrator, and extract registry data, GreyNoise says .
Metrics
victims
49
Organizations
According to the researchers, the threat actor leveraged the wp2shell vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in the WordPress Core component to breach at least 49 organizations in 29 countries.
Metrics
infrastructure
‎Linux
Affected Product
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
Metrics
infrastructure
847
Pipe Flaw
GreyNoise also confirmed targeting of PAN-OS GlobalProtect, FlowiseAI (CVE-2026-56271), the Linux kernel’s Dirty Pipe flaw (CVE-2022-0847), Gitea (CVE-2026-60004), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569) and Proxmox VE (CVE-2023-54391).
Metrics
data_breach
18,500
Records
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.
Metrics
data_breach
18,566
Records
After locating credentials for a backend SQL database, the attackers used them in a password-spraying attack that gave them access to an internal SQL server, from which they stole at least 18,566 records.
Intelligence Sources
BleepingComputer 2026-09-22
AlienVault OTX 2026-09-23
AlienVault OTX 2026-09-22