Hacker cinesi violano 996 dispositivi WordPress e ZyXEL, rubati 18.500 record

A Chinese hacking group has spent months methodically breaking into government agencies and police forces across the Western world, exploiting known security gaps in WordPress installations and network switches to steal tens of thousands of sensitive records. The campaign, tracked by threat intelligence firm GreyNoise, began in June 2026 and has compromised 996 devices across 48 countries, extracting more than 18,500 database records containing account credentials, plaintext passwords, and personal information tied to law enforcement and government officials.

The attackers operated with clear purpose and patience. They used two WordPress vulnerabilities, catalogued as CVE-2026-63030 and CVE-2026-60137 and collectively known as wp2shell, to breach at least 49 organizations spread across 29 countries. Public exploits for these flaws appeared in mid-July; within days, the same group was already using them in active attacks. The targeting was precise. While many victims were small businesses and public administration offices, one intrusion stood out: a Western government agency whose name has not been disclosed. There, the attackers deployed a customized version of the wp2shell exploit and then conducted an exhaustive reconnaissance of the Windows environment, probing Microsoft Defender settings, AMSI protections, running services, open ports, local accounts, application restrictions, and database configurations. In 36 minutes, they tested 17 different scripts designed to bypass AMSI defenses, escalate privileges through token theft and impersonation, create new administrator accounts, and extract data from the system registry. Once they identified credentials for a backend SQL database, they used password spraying to gain access to an internal SQL server. From that server, they stole at least 18,566 records—account information, passwords stored in plaintext, and personal details belonging to government and police agencies. The same actor also breached a Russian state organization operating in occupied Ukrainian territory, an incident researchers described as a red-on-red compromise.

The campaign expanded in scope on August 17, when the group shifted focus to network infrastructure. They exploited a high-severity vulnerability in ZyXEL GS1900 Smart Managed switches, tracked as CVE-2026-7273, targeting 996 devices in 48 countries. From these switches, they extracted network configurations, infrastructure details, and root credentials in hash format—valuable intelligence for moving deeper into target networks without detection. Simultaneously, they attempted to chain together three vulnerabilities in Ubiquiti UniFi OS, designated CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, to achieve remote code execution with root privileges. The U.S. Cybersecurity and Infrastructure Security Agency had already flagged these three flaws as actively exploited since late June 2026.

The breadth of the group's toolkit is striking. Beyond WordPress and ZyXEL, researchers confirmed attack attempts against Palo Alto Networks PAN-OS GlobalProtect, FlowiseAI, the Linux kernel vulnerability Dirty Pipe, Gitea, Nuclio, SENAITE LIMS, and Proxmox VE. Each target represented a documented security flaw with a known patch. Yet a troubling detail emerged: not all the vulnerabilities used in this cluster of attacks have been added to the CISA Known Exploited Vulnerabilities catalog, the authoritative list of flaws known to be actively exploited in the wild. That gap suggests the attackers maintain a tactical advantage and may continue striking unpatched infrastructure before defenders can fully respond. GreyNoise has released indicators of compromise tied to the observed activity, including backdoor hashes and references to command-and-control infrastructure, but the group's next moves remain unknown.