A Chinese-speaking threat actor has spent months chaining exploits across a wide swath of edge devices and web platforms to steal sensitive data, according to new research from threat intelligence firm GreyNoise. The campaign, detailed in a report titled "Open Season on Kapibala," compromised 996 Zyxel GS1900 Smart Managed Switches across 48 countries and breached 49 organizations in 29 countries through a WordPress exploit chain — with the most severe incident pulling more than 18,566 records, including plaintext passwords and personally identifiable information, from the backend database of a Western government organization.
A Sprawling Exploitation Campaign
GreyNoise's Global Observation Grid (GOG), a network of internet-wide sensors, first picked up scanning and exploitation activity tied to a single IP address in early June 2026. Analysts assess with confidence that activity dating back to May 7, 2026 belongs to one malicious cyber actor — a suspected Chinese speaker likely operating in the UTC+8 time zone, based on operational timing and extensive Chinese-language comments embedded in the actor's custom tooling. GreyNoise links the operator to (or considers it related to) "Red Heron," a group previously documented by Acronis, citing overlap in command-and-control infrastructure, malware family, and tactics, including earlier exploitation of a Gitea flaw.
Rather than focusing on a single product, the actor built a toolkit spanning at least eight distinct technologies: Zyxel GS1900 switches, WordPress, PAN-OS GlobalProtect, Ubiquiti UniFi OS, FlowiseAI, Gitea, Nuclio, SENAITE LIMS, and Proxmox VE — plus the long-known Linux Dirty Pipe kernel flaw (CVE-2022-0847) for local privilege escalation. GreyNoise catalogued at least 17 script variants in the actor's arsenal, some purpose-built to evade Microsoft's Antimalware Scan Interface, probe privilege-escalation paths, and manipulate authentication tokens.
The Zyxel GS1900 Switch Campaign
Beginning August 17, 2026, the actor started exploiting CVE-2026-7273, a stack-based buffer overflow in Zyxel's GS1900 Smart Managed Switch line, carrying a CVSS score of 8.8. The flaw lets an unauthenticated attacker execute OS-level commands on a vulnerable switch via a specially crafted HTTP request. According to GreyNoise, this marks the first publicly documented case of the vulnerability being exploited in the wild.
The exploit code itself was delivered as a Python script heavily obfuscated with the commercial tool PyArmor, and it explicitly targeted GS1900-24 firmware versions 2.10 through 2.90. Once a device was compromised, the actor used TFTP to pull down and run a custom collector script that harvested device configurations, networking details, and hashed root-level credentials. Of the 996 compromised switches, spread across 48 countries and concentrated in Italy, the United States, Taiwan, South Korea, and several EU member states, 564 were still running factory-default credentials — meaning the attacker likely didn't even need the buffer overflow to gain a foothold on more than half the fleet.
Zyxel privately received the report and shipped patched firmware for ten affected GS1900 models in June 2026, roughly two months before exploitation began in earnest. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog on September 21, 2026, giving federal civilian agencies until September 24 to apply the fix under Binding Operational Directive 22-01.
The WordPress "wp2shell" Exploit Chain
On or around July 20, 2026, the same actor pivoted to WordPress, using an exploit chain researchers dubbed wp2shell. It combines two flaws: a route-confusion bug in the WordPress REST API batch endpoint (CVE-2026-63030) and a SQL injection vulnerability in the WP_Query component's author__not_in parameter (CVE-2026-60137). Chained together, the pair lets an unauthenticated attacker achieve arbitrary code execution without needing a vulnerable plugin, valid credentials, or any prior access to the target site.
Using wp2shell, the actor planted a persistent web shell and dumped WordPress user tables at 49 organizations across 29 countries, most of them small businesses and government entities. The campaign's worst outcome hit an unnamed Western government organization: GreyNoise called it "the most egregious data theft" it observed, with attackers extracting more than 18,000 sensitive records — accounts, plaintext passwords, and personal information tied to law-enforcement and government personnel — directly from the site's backend database.
In an unusual twist, GreyNoise also observed the same actor compromise a Russian state entity operating in Russia-occupied Ukraine — a rare documented instance of one nation-state-aligned operator hitting infrastructure tied to another.
Why This Matters
This campaign is a case study in how much damage a single, well-resourced actor can do by treating N-day vulnerabilities as a portfolio rather than picking one target technology. Zyxel patched CVE-2026-7273 in June, yet exploitation didn't require a zero-day — it required operators who track disclosures, build weaponized tooling quickly, and then sweep the internet for anyone who hasn't patched. The fact that more than half the compromised switches were still on factory-default credentials compounds the lesson: patching alone would not have fully closed this door.
The government data theft is the sharpest reminder of the stakes. Plaintext passwords and PII tied to law-enforcement and government personnel, sitting in a WordPress backend reachable by an unauthenticated exploit chain, is the kind of exposure that turns a content-management-system bug into a national-security incident. Organizations running public-facing WordPress instances or unmanaged network edge devices should treat both as part of their attack surface — not just their servers and endpoints.
Protective Measures
- Patch Zyxel GS1900 switches immediately. Update to the firmware versions Zyxel released in June 2026 for the ten affected GS1900 models, and replace any device still running 2.10 through 2.90.
- Eliminate factory-default credentials. Audit every network device for default admin logins — 564 of the 996 compromised switches in this campaign had never had their credentials changed.
- Patch WordPress core promptly and monitor for wp2shell indicators. Apply fixes for CVE-2026-63030 and CVE-2026-60137, and review the WordPress user table for unexpected administrator accounts or ones designed to resemble legitimate domain addresses.
- Restrict management interfaces to trusted networks. Neither the Zyxel switch management UI nor WordPress admin endpoints should be reachable directly from the open internet where avoidable; put them behind a VPN, allowlist, or bastion host.
- Monitor for GreyNoise-published indicators of compromise. GreyNoise's Global Observation Grid has published IOCs tied to this actor's infrastructure — feed them into perimeter detection and block lists.
- Treat N-day exposure as an ongoing risk, not a one-time patch cycle. This actor exploited a Zyxel flaw roughly two months after a patch existed; maintain a recurring asset inventory and patch-verification cadence rather than assuming a single remediation pass is sufficient.
Sources
- BleepingComputer — Chinese hackers exploit multiple technologies to steal govt data
- BleepingComputer — CISA orders feds to patch Zyxel flaw exploited for data theft
- GreyNoise — Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
- Help Net Security — Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)