Chinese-speaking threat actor exploits ZyXEL and WordPress vulnerabilities to exfiltrate government data

According to reporting from BleepingComputer, a Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. The actor leverages multiple technologies in a coordinated campaign targeting government entities. The specific vulnerabilities exploited have not been detailed in the reporting, but the compromise of Smart Managed Switches and WordPress instances provides the actor with network access and web application footholds respectively. The stolen data includes sensitive records from government databases. The exact initial access vector and the full extent of the exfiltrated data remain under investigation. Security researchers advise organizations using the affected products to review security configurations, apply available patches, and monitor for suspicious activity.