Chinese Hackers Exploit Switches and WordPress, Steal Government Data

How the Attack Chain Was Constructed

Security researchers discovered a multi‑stage operation that combined hardware and software weaknesses to infiltrate government networks. The actor first gained a foothold by targeting ZyXEL GS1900 smart managed switches, then moved laterally to compromised WordPress installations that served as data collection points. By chaining these exploits, the group was able to extract sensitive information from more than 996 devices and over 18,500 database entries.

Vulnerabilities in ZyXEL GS1900 Switches

The GS1900 series suffered from several critical bugs, including unauthenticated command injection and improper access controls. These flaws allowed an attacker to execute arbitrary code on the switch firmware, effectively turning the device into a remote proxy. Once inside the network, the compromised switch could intercept traffic, capture credentials, and open tunnels for further exploitation.

Details of the vulnerabilities were published in a public advisory by the U.S. Cybersecurity and Infrastructure Security Agency. Organizations are encouraged to review the CISA alert on ZyXEL devices for technical guidance.

Exploiting WordPress Sites

Parallel to the hardware breach, the threat actor scanned for WordPress installations that ran outdated plugins or themes. Known vulnerabilities in popular plugins permitted file upload attacks, granting the attacker write access to the web server. The compromised sites were then used to host malicious scripts that harvested data from connected backend databases.

The official WordPress security page outlines best practices for hardening sites, including regular updates and the removal of unused plugins. See the WordPress security documentation for more information.

Scope of the Data Compromise

Analysis of the exfiltrated data revealed a focus on government agencies that manage public services and infrastructure. The attackers targeted systems that stored citizen records, internal communications, and configuration files for critical devices.

Targeted Government Devices

Among the compromised hardware were routers, firewalls, and the aforementioned smart switches. The attackers leveraged the switch vulnerability to bypass network segmentation, allowing them to reach devices that were otherwise isolated.

Volume of Records Accessed

Forensic investigators counted more than 18,500 records extracted from backend databases. The data set included personal identifiers, email addresses, and internal policy documents. While the full impact on national security remains under assessment, the breach demonstrates the potential for large‑scale data loss when multiple entry points are exploited simultaneously.

Response from Vendors and Agencies

Both ZyXEL and the WordPress community responded quickly after the vulnerabilities were disclosed. Patches were released within weeks, and security advisories were distributed to customers worldwide.

ZyXEL Patch Deployment

ZyXEL issued firmware updates that addressed the command injection and access control flaws. The company also provided a migration guide to help administrators apply the patches without disrupting network operations. Organizations are urged to verify that the latest firmware version is installed on all GS1900 devices.

WordPress Security Updates

The WordPress core team released a series of updates that fixed the plugin execution paths exploited by the attackers. In addition, the community emphasized the removal of abandoned plugins and the adoption of security plugins that monitor file changes.

For a comprehensive overview of patch management best practices, refer to the National Vulnerability Database and the NIST guide on patch management.

Lessons for Organizations

The incident underscores several key security principles that all enterprises, especially those handling public sector data, should reinforce.

Importance of Patch Management

Regularly updating firmware and software eliminates known attack vectors before they can be weaponized. Automated patch deployment tools can reduce the window of exposure caused by manual processes.

Monitoring Network Devices

Continuous monitoring of network hardware for anomalous traffic patterns helps detect compromised devices early. Implementing intrusion detection systems that can flag unexpected command execution on switches adds an extra layer of defense.

• Maintain an inventory of all network assets.
• Apply security baselines recommended by industry standards.
• Conduct periodic vulnerability scans on both hardware and web applications.
• Enforce least‑privilege access for administrative accounts.
• Educate staff on phishing and social engineering tactics that often precede technical exploits.

By integrating these practices, organizations can reduce the likelihood of a coordinated attack that spans multiple technology stacks.

As threat actors continue to blend hardware and software exploits, a holistic security strategy that treats every component as a potential entry point becomes essential. Ongoing collaboration between vendors, government agencies, and security researchers will be critical to stay ahead of evolving tactics.