Chinese-speaking hackers exploit ZyXEL, WordPress flaws to steal data from 996 devices

A Chinese-speaking threat actor exploited vulnerabilities in ZyXEL GS1900 switches and WordPress to exfiltrate sensitive data from 996 devices and over 18,500 database records. The attack targets government data, indicating a state-sponsored or aligned operation. The scale and specific targeting suggest a coordinated campaign, though attribution remains based on language and TTPs.