Multi-product intrusion campaign tied to attacks on 996 devices

Exploitation of known flaws across 48 countries

According to GreyNoise research covered by BleepingComputer, a Chinese-speaking threat actor exploited known flaws in WordPress, ZyXEL GS1900 Smart Managed Switches, and other products.

The researchers said the activity reached devices in 48 countries and that an intrusion at an unnamed Western government organization resulted in the theft of at least 18,566 database records containing accounts, plaintext passwords, and personally identifiable information linked to government and law-enforcement agencies.

Researchers had observed exploitation of the wp2shell WordPress flaws shortly after public exploits became available in mid-July.

GreyNoise now links that activity to a broader campaign that reportedly targeted multiple products, including ZyXEL GS1900 switches, and attributes compromises of 996 devices to the actor.

Cross-product activity and stolen records

The reported activity combines exploitation of web software, network equipment, and other enterprise-facing technologies rather than relying on a single product. GreyNoise also said some flaws linked to the cluster were not in CISA's Known Exploited Vulnerabilities catalog.