The attackers chained together vulnerabilities across multiple technologies rather than relying on a single entry point. WordPress installations and the ZyXEL GS1900 switch platform were both abused as part of the intrusion set, with backend databases serving as the primary target for data collection.

Key facts reported so far:

• Threat actor profile: Chinese-speaking group
• Targeted technologies: ZyXEL GS1900 Smart Managed Switches and WordPress
• Scale of impact: 996 devices compromised
• Data exposure: over 18,500 records from backend databases
• Victim sector: government

At this stage, the reporting does not provide specific CVE identifiers for the vulnerabilities involved. Organizations running ZyXEL GS1900 switches or externally exposed WordPress instances should treat this as a prompt to review patch levels, restrict management interface exposure, and audit backend database access logs for anomalous activity.

Source: BleepingComputer

Does your organization run ZyXEL GS1900 switches or externally facing WordPress sites, and how are you prioritizing patching and exposure reduction in response?