Chinese Hackers Exploit WordPress, Zyxel Flaws for Govt Data

Executive Summary

A prolific Chinese-speaking cyber espionage cluster closely associated with the Red Heron threat collective has executed a coordinated global intrusion campaign. Telemetry captured by GreyNoise's Global Observation Grid (GOG) reveals that the threat actor systematically compromised at least 49 victim organizations distributed across 29 countries, including municipal governments, critical infrastructure operators, and law enforcement agencies.

The intrusion campaign demonstrates an aggressive multi-technology targeting doctrine. Rather than relying on a single exploit vector, the threat actors chained public and weaponized vulnerabilities across edge network hardware and content management systems. The primary intrusion vectors involved the automated exploitation of the wp2shell vulnerability chain in WordPress (CVE-2026-63030 and CVE-2026-60137) alongside a critical configuration extraction flaw in ZyXEL GS1900 Smart Managed Switches (CVE-2026-7273), which led to the compromise of 996 perimeter switches across 48 countries.

In one high-profile breach of a Western government entity, the threat actor established initial access via wp2shell, executed a 36-minute evasion sequence testing 17 distinct AMSI and privilege escalation scripts, and located backend SQL database credentials. Through subsequent internal password spraying, the adversary exfiltrated over 18,566 records containing plaintext passwords, administrative credentials, and classified personnel dossiers.

Technical Vulnerability Analysis & Attack Chain

The threat actor's kill chain highlights rapid opportunistic weaponization combined with methodical post-exploitation operational security:

1. Reconnaissance & Automated Surface Scanning: Beginning in early June 2026, the operators established persistent scanning nodes targeting unsegmented perimeter services. The adversary probed for exposed ZyXEL GS1900 administrative ports, vulnerable WordPress endpoints, PAN-OS GlobalProtect gateways, and self-hosted Gitea instances.
2. Multi-Vector Perimeter Exploitation: The campaign utilized automated exploit payloads against ZyXEL GS1900 switches affected by CVE-2026-7273, dumping device configuration backups containing hashed administrator credentials and network routing tables. Concurrently, the actors deployed custom exploits targeting WordPress core and plugin vectors (wp2shell, CVE-2026-63030 and CVE-2026-60137) to achieve unauthenticated remote code execution.
3. Host Ingress & Defense Evasion: Upon establishing a web shell on compromised web hosts, the adversary executed automated reconnaissance scripts querying AMSI provider registration, Microsoft Defender real-time scanning states, active network listeners, and AppLocker policies. In the documented Western government intrusion, the actor sequentially evaluated 17 bypass techniques within a 36-minute window to evade host detection.
4. Credential Harvesting & Privilege Escalation: The actor attempted local privilege escalation via Linux kernel Dirty Pipe (CVE-2022-0847) and Windows token impersonation. System configuration files and web server environment variables (wp-config.php) were scraped to extract cleartext database connection strings.
5. Internal Pivoting & Database Exfiltration: Leveraging the recovered SQL credentials, the actor performed automated password-spraying attacks against internal subnets. Upon locating the primary agency database cluster, the attacker executed mass SQL dumping routines, exfiltrating 18,566 records comprising government employee credentials, plaintext credentials, and internal agency records to foreign staging servers.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Threat telemetry links this campaign to an advanced Chinese-speaking espionage cluster affiliated with Red Heron. Historically recognized for targeting developer toolchains and source code repositories (including Gitea zero-day exploits under CVE-2026-60004), Red Heron demonstrates high operational adaptability by incorporating diverse edge appliances into its collection infrastructure.

Notably, telemetry captured intrusions spanning 49 organizations in 29 countries across North America, Europe, East Asia, and the Middle East. Beyond Western government targets, the campaign compromised a Russian state administrative entity situated in occupied Ukrainian territory, confirming non-aligned, multi-directional state intelligence requirements ("red-on-red" espionage).

In addition to ZyXEL and WordPress, GreyNoise observed the cluster actively targeting Ubiquiti UniFi OS instances (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), FlowiseAI (CVE-2026-56271), Nuclio (CVE-2026-79756), SENAITE LIMS (CVE-2026-54569), and Proxmox VE virtualization environments (CVE-2023-54391).

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• ZyXEL GS1900 Switches: Apply vendor firmware updates addressing CVE-2026-7273 immediately. Ensure switch web management consoles and SNMP services are isolated to out-of-band management VLANs and blocked from public routing.
• WordPress Core & Plugins: Upgrade WordPress deployments to version 6.6.2 or higher. Immediately disable or patch plugins vulnerable to wp2shell exploit primitives (CVE-2026-63030 and CVE-2026-60137).
• Database Credential Rotation: Force enterprise-wide password resets for all database accounts referenced in web application configuration files. Enforce TLS mutual authentication (mTLS) for database client connections.

2. Network & Perimeter Defenses

• Restrict inbound management access across edge appliances (ZyXEL, PAN-OS, Proxmox, Ubiquiti) using strict IP access control lists (ACLs).
• Deploy perimeter Web Application Firewall (WAF) inspection rules to inspect inbound HTTP POST requests containing serialized PHP objects or anomalous base64 strings targeting WordPress endpoints.
• Segregate internal database tiers from DMZ web application servers; deny direct database access across unrelated internal segments.

3. Endpoint Detection & Hunting Query

title: Suspicious WordPress Web Server Child Process and AMSI Bypass Activity
id: 9a7b4c12-8e34-4a21-912f-6825c0e718b5
status: experimental
description: Detects suspicious process spawning from web server engines (w3wp.exe, httpd.exe, nginx.exe) attempting AMSI bypass or PowerShell token impersonation.
author: CyberNewsAI Threat Intelligence
references:
  - https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/
tags:
  - attack.t1190
  - attack.t1059.001
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\cscript.exe'
  selection_cli:
    CommandLine|contains:
      - 'AmsiUtils'
      - 'amsiInitFailed'
      - 'System.Management.Automation'
      - 'MiniDump'
      - 'Invoke-TokenManipulation'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Legitimate administrative automation scripts run by web applications
level: high

// Microsoft Sentinel / Defender Hunting Query: Detect Web Shell Activity and Database Reconnaissance
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "php.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "sqlcmd.exe", "osql.exe")
| where ProcessCommandLine has_any (
    "AmsiUtils",
    "amsiInitFailed",
    "wp-config.php",
    "Invoke-TokenManipulation",
    "Get-ProcessToken",
    "sqlcmd",
    "INFORMATION_SCHEMA",
    "SELECT * FROM",
    "sys.tables"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, DeviceId
| sort by Timestamp desc

Network Indicators & Targeting Nodes

Exploited CVE Identifiers