Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
-
A Chinese-speaking threat actor has been observed exploiting flaws in ZyXEL GS1900 Smart Managed Switches and WordPress to exfiltrate sensitive data from government targets. According to the reporting, the campaign resulted in the theft of data from 996 devices and more than 18,500 records stored in backend databases.
The attackers chained together vulnerabilities across multiple technologies rather than relying on a single entry point. WordPress installations and the ZyXEL GS1900 switch platform were both abused as part of the intrusion set, with backend databases serving as the primary target for data collection.
Key facts reported so far:
- Threat actor profile: Chinese-speaking group
- Targeted technologies: ZyXEL GS1900 Smart Managed Switches and WordPress
- Scale of impact: 996 devices compromised
- Data exposure: over 18,500 records from backend databases
- Victim sector: government
At this stage, the reporting does not provide specific CVE identifiers for the vulnerabilities involved. Organizations running ZyXEL GS1900 switches or externally exposed WordPress instances should treat this as a prompt to review patch levels, restrict management interface exposure, and audit backend database access logs for anomalous activity.
Source: BleepingComputer
Does your organization run ZyXEL GS1900 switches or externally facing WordPress sites, and how are you prioritizing patching and exposure reduction in response?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login