A Chinese-speaking threat actor has been chaining vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress Core to compromise 996 devices and steal more than 18,500 records from backend databases, according to telemetry from threat intelligence firm GreyNoise reported by BleepingComputer (S1). The campaign has been running since early June 2026, spans at least 49 organizations across 29 countries, and culminated in a single intrusion at an unnamed Western government organization where the attacker pulled at least 18,566 records off an internal SQL server. It is worth stating up front what the sourcing supports: this specific campaign is documented by one outlet-tier report drawing on one vendor's sensor network. No victim statement, regulator filing, vendor advisory or national CERT bulletin has been published for it. The other sources in this package cover adjacent PRC-nexus and data-exposure incidents rather than corroborating this one.
What Happened
GreyNoise detected the activity through its Global Observation Grid (GOG) sensor network. Scans and exploitation attempts attributed to the actor originate from a single IP address and have been logged since early June 2026. GreyNoise links the operator to the Red Heron group, previously associated with exploitation of a critical flaw in the Gitea self-hosted Git service.
The targeting is broad rather than surgical. Beyond ZyXEL switches and WordPress, the actor threw exploits for known issues at PAN-OS GlobalProtect, FlowiseAI, Nuclio, Proxmox and Ubiquiti gear. The through-line is opportunism against edge and management-plane technology that tends to sit outside EDR coverage.
The WordPress vector is the "wp2shell" pair, tracked as CVE-2026-63030 and CVE-2026-60137 in WordPress Core. Public exploits for wp2shell landed in mid-July 2026, with active exploitation observed days later. GreyNoise's campaign timeline starts around the same window, and the actor was using a custom wp2shell exploit rather than the commodity public version. Most victims fell into small business and government categories.
The standout intrusion is the Western government organization. After initial access via the custom wp2shell exploit, the operator ran extensive Windows and security reconnaissance: Microsoft Defender status, AMSI, running services, listening ports, local accounts, application restriction policies and database configuration. Over a 36-minute window, GreyNoise counted 17 distinct scripts attempting AMSI bypass, privilege escalation via token impersonation or theft, creation of a local administrator account, and registry extraction. Having found credentials for a backend SQL database on the compromised host, the actor reused them in a password-spraying attack that yielded access to an internal SQL server.
What Was Taken
The headline figures are 996 compromised devices and "more than 18,500 records" of sensitive government data, with the SQL server theft at the Western government victim specified as at least 18,566 records (S1). Those two numbers are not in conflict; the ~18,500 aggregate figure and the 18,566 floor from the single government intrusion appear to describe the same haul, which means one victim accounts for effectively the entire record count reported so far. The 996-device figure and the 49-organizations-in-29-countries figure describe the wider exploitation footprint, not additional confirmed data theft.
What is not established: the content and classification of those 18,566 records, the identity or nationality of the government body, whether any affected individuals have been notified, and whether the 996 devices represent full compromise or successful exploitation without follow-on access. GreyNoise's visibility is sensor-derived, which is strong on attempted and observed exploitation and weaker on downstream impact inside victim networks. Treat the record count as a floor from one telemetry source rather than a settled total, and expect it to move if the victim or a CERT ever publishes.
Why It Matters
The strategic picture around this campaign is corroborated by the primary-tier material in this package even though that material covers a different operation. On 26 August 2026, the US Justice Department and FBI announced court-authorized seizures of domains behind two complementary hacking platforms, "QScan" and "QTRouter," operated by a PRC state-sponsored group designated "QTFY" and employed by Nanjing Xinjiuwei Network Technology Company (S2). Court documents unsealed in the Southern District of California name NASA, the Federal Reserve, the Department of Energy, the Department of Justice, HHS, NIH and the US Senate among the targets, with hospitals, telecommunications providers, power companies, financial institutions and defense contractors also in scope.
Accounts of that operation differ in a way defenders should note. Reuters headlined it as Chinese hackers having "broke into" the Justice Department, NASA, the Federal Reserve and the Senate, and reports the affidavit identifies Energy, HHS, NIH and four US and South Korean companies as victims, with activity dating to at least 2018 (S5). CNBC reports that DOJ originally announced the federal agencies as victims of computer intrusion but, as of 28 August, updated its press release to describe them as targets instead (S4). DOJ has not detailed damage to any agency. The distinction between targeted and breached is doing real work there, and the primary source moved in the more conservative direction.
The relevance to the ZyXEL and WordPress campaign is the tradecraft, not the attribution. FBI Director Kash Patel described QScan and QTRouter as tools "used by PRC cyber actors to hide the origin of their attacks" (S2). Compromised edge devices, routers and small managed switches are the raw material for that kind of relay infrastructure. A campaign hitting 996 ZyXEL switches produces exactly the sort of inventory that feeds an obfuscation network, whether or not this particular operator is connected to QTFY. Nothing in the sourcing establishes such a link, and none should be inferred.
Two further items in this package sharpen the exposure picture. The Register (S3) and Reuters coverage carried by MarketScreener and the Indian Express (S6, S7) report that Chinese AI firm Z.ai apologized after its ZCode coding harness packaged entire user workspaces, including complete project histories, and uploaded them to Alibaba Cloud. Accounts of the root cause differ slightly: Z.ai attributed it to a default-enabled "Codebase Indexing" feature it has since patched, while researcher Ferstar, as reported by The Register, located the problem in Repository Index functionality triggered after Repo Wiki generated cloud pages, with no user-facing off switch and no disclosure in the privacy policy. Users reported the uploaded data was encrypted with a private key held only by Z.ai, leaving them unable to open or independently verify deletion of their own files. Z.ai says CAICT and NSFOCUS assessed the product and concluded all uploaded data has been deleted, and that Repo Wiki was removed. Separately, Nature reports the UK Biobank imposed new safety measures and suspended access following a security incident affecting one of the world's top research biobanks (S8). Credentials, source code and research data are all leaking through channels that traditional network defense does not watch.
The Attack Technique
The kill chain here is unglamorous and highly repeatable, which is precisely why it works:
- Mass scanning from fixed infrastructure. All observed scans and attacks trace to a single IP, active since early June 2026. That is a detectable indicator, and it suggests the operator was not investing heavily in origin obfuscation for this campaign.
- N-day exploitation across a broad technology surface. ZyXEL GS1900 switches, WordPress Core, PAN-OS GlobalProtect, FlowiseAI, Nuclio, Proxmox and Ubiquiti. All known issues. No zero-day is reported.
- Custom weaponization of a public bug. The wp2shell chain (CVE-2026-63030, CVE-2026-60137) went public in mid-July with exploitation following within days. The actor built its own variant, which implies capability above script-kiddie baseline and complicates signature-based detection tuned to the public PoC.
- Aggressive post-exploitation reconnaissance. Defender state, AMSI, services, listening ports, local accounts, application restrictions, database configuration. The actor was explicitly mapping defensive controls before acting.
- Rapid, scripted privilege escalation. 17 scripts in 36 minutes covering AMSI bypass, token impersonation and theft, local administrator creation and registry extraction. That cadence suggests a prepared toolkit fired in sequence, with the operator iterating until something landed.
- Credential harvesting to lateral movement. Database credentials recovered from the compromised host were sprayed against an internal SQL server. Password reuse, not a further exploit, is what turned a web compromise into a government data breach.
Step six is the one that matters most. The exploit got them a foothold. Credential reuse got them the data.
What Organizations Should Do
- Patch WordPress Core immediately and hunt retroactively. CVE-2026-63030 and CVE-2026-60137 have had public exploits since mid-July 2026. Any internet-facing WordPress instance that was unpatched during that window should be treated as potentially compromised, not merely as needing an update. Review webshell artifacts, unexpected PHP files and admin account creation back to mid-July.
- Inventory and patch ZyXEL GS1900 switches and the rest of the named surface. GS1900 series, PAN-OS GlobalProtect, FlowiseAI, Nuclio, Proxmox and Ubiquiti devices. Management interfaces for switches and hypervisors should never be reachable from the internet; if they are, that is the highest-value fix available today.
- Break the credential reuse chain. The government victim lost 18,566 records because database credentials sat on a web-facing host and worked elsewhere. Move service credentials into a vault, rotate anything that has ever been stored in application config or registry, and ensure SQL service accounts are unique per host and per environment.
- Enforce lockout and alerting on database authentication. A password-spraying attack against an internal SQL server should generate alerts, not access. Rate-limit and lock out on repeated failures, and alert on successful authentication from a host that has no business talking to that server.
- Detect the escalation pattern, not the individual tool. Seventeen scripts in thirty-six minutes is a signature in itself. Alert on rapid sequential PowerShell execution, AMSI tampering, token impersonation and local administrator account creation, especially on web servers where none of this is normal behavior.
- Govern AI coding tools as a data egress channel. The Z.ai/ZCode incident shows default-on indexing features shipping entire repositories, including history, to third-party cloud storage without disclosure. Audit which AI coding assistants are in use, what they upload by default, and whether your organization retains the ability to verify deletion. Assume you cannot until proven otherwise.
- Treat the 996-device figure as a floor. One sensor network sees what it sees. If you run any of the affected technologies and have not hunted, absence of evidence is not evidence of absence.
Sources: Chinese hackers exploit WordPress, Zyxel flaws to steal govt data | Justice Department and FBI Seize Platforms Operated and Used by ... | Z.ai says sorry for slurping up your code, open sources ZCode | Fed, NASA, DOJ targeted by Chinese state-sponsored hackers | US says Chinese hackers broke into Justice Department ... - Reuters | China's Z.ai disables AI coding assistant features after security i... | China’s Z.ai disables AI coding assistant features after security i... | A data leak shut a top research biobank: lessons from the recovery...