Hackers Exploit WordPress and Zyxel Flaws to Steal Government Data

The WordPress Zyxel attacks have exposed government-linked records and configurations from nearly 1,000 network switches, according to GreyNoise. Researchers attribute the activity to a Chinese-speaking threat actor operating across dozens of countries.

GreyNoise connected the incidents through activity originating from the same IP address. Its sensors have recorded related scanning and exploitation since early June 2026.

WordPress Intrusion Exposes Government Records

GreyNoise says the attacker used two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to breach at least 49 organizations in 29 countries. Researchers refer to the flaws collectively as wp2shell.

One intrusion affected an unnamed Western government organization. After gaining access, the attacker examined Windows security controls, local accounts, running services and database settings.

Over 36 minutes, the actor tried 17 scripts. Those attempts included efforts to bypass security scanning, gain higher privileges and create a local administrator account.

The attacker then found credentials for a backend SQL database. According to GreyNoise, a subsequent password-spraying attack opened access to an internal SQL server.

From that server, the actor stole at least 18,566 records. Researchers say the data included accounts, plaintext passwords and personal information associated with government and law-enforcement agencies.

Zyxel Switch Flaw Affects 996 Devices

On August 17, the same actor began exploiting CVE-2026-7273 in Zyxel GS1900 Smart Managed Switches, GreyNoise reports.

The campaign compromised 996 devices across 48 countries. Attackers extracted device configurations, network details and hashed root-level credentials.

These details could help an attacker understand how an affected network operates. However, the report does not establish that every compromised switch led to further access inside its organization.

Actor Also Probes Other Technologies

GreyNoise observed the actor targeting several other products, including PAN-OS GlobalProtect, FlowiseAI, Gitea, Nuclio and Proxmox VE. The researchers also saw attempts to combine three UniFi OS vulnerabilities to gain root-level code execution.

The WordPress Zyxel attacks show how the actor used different known flaws against web applications and network infrastructure. Still, the confirmed outcomes differ by target. GreyNoise documented stolen records in the government intrusion and extracted configurations from the Zyxel switches.

The company has released indicators of compromise related to the campaign. Organizations running affected products can use those findings to review their systems, apply available fixes and investigate suspicious access.