996 ZyXEL Switches Hacked by a Chinese Collector Group: 564 Still Had Default Passwords

A Chinese-linked hacking group has compromised almost 1,000 ZyXEL office switches across 48 countries. The number that should worry African IT teams is 564. That is how many of the breached devices were still running factory default credentials.

On Monday, threat intelligence firm GreyNoise published observations of a Chinese-speaking, state-affiliated actor exploiting CVE-2026-7273, a stack-based buffer overflow in ZyXEL’s GS1900 Smart Managed Switch line. The flaw needs no authentication: a crafted HTTP request to the management interface gets you OS-level command execution. CVSS 8.8. ZyXEL shipped fixes for ten GS1900 models back in June. Most of the 996 compromised devices never installed them.

The same week, CISA added the bug to its Known Exploited Vulnerabilities catalog and gave US federal agencies three days to patch under BOD 26-04. When a three-letter agency starts counting the deadline in days, the threat has stopped being theoretical.

What the attackers took

GreyNoise’s researchers watched the operator run a heavily obfuscated Python script against vulnerable firmware (2.10 through 2.90 on the GS1900-24, with command-line options to retarget other firmware in scope). Each pass pulled out the same haul: hashed root credentials, full device configurations, internal network topology. For an espionage team, a switch config is a map of your network, every VLAN and trunk link and management address that was never supposed to be reachable from outside.

Here is the part that stings. Of the 996 breached devices, 564 had factory default credentials. The attacker owned the box through the exploit and then discovered the admin password was still whatever ZyXEL printed on the label. Those devices were effectively open even without the CVE.

The switch was one door among many

The ZyXEL activity is a slice of a broader campaign, not a standalone crime. GreyNoise traced scans and attacks from the same IP infrastructure going back to early June, attributed to an actor related to the group Acronis tracks as Red Heron. The same operator:

• Used the wp2shell WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to breach at least 49 organizations in 29 countries. Public exploits landed in mid-July; intrusions followed within days.
• Against one Western government target, ran 17 different scripts over 36 minutes on a compromised Windows host, probing Defender, AMSI, listening ports and local accounts before escalating privileges and dumping registry data. They found backend SQL credentials in the dump, sprayed them against an internal database server, and left with 18,566 records containing accounts, plaintext passwords and personally identifiable information tied to government and law-enforcement agencies.
• Chained three Ubiquiti UniFi OS flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) for root-level remote code execution. CISA flagged all three as actively exploited in late June.
• Breached a Russian state organization in occupied Ukraine, which GreyNoise dryly calls a “red-on-red” compromise.

Read that list again and the shape of the operator comes into focus: a collector. Switch configs, database dumps, network maps. No ransomware note, no manifesto, no disruption for its own sake. Someone is quietly building an inventory of other people’s infrastructure, and access to a small managed switch is cheap, durable, and almost never monitored.

Why this lands differently in African enterprises

Walk through most South African SME server rooms and you will find exactly the asset class in this story. A rack of unassuming smart managed switches and UniFi access points, installed by an integrator five years ago, password never changed, management interface technically LAN-only, except someone forwarded a port for remote support in 2023 and nobody remembers it. EDR does not see these devices. Asset inventories miss them. Patch cycles stop at the laptop fleet.

The GS1900 is not a niche product. It is the default cheap-and-cheerful choice for offices across the continent, sold through every IT distributor in Johannesburg, Lagos and Nairobi. If 996 devices fell in roughly six weeks to an actor working a single CVE, then your exposure is a function of how many of those boxes sit unpatched behind one accidentally exposed management port.

Also worth noticing is the pacing. Vendor patches in June. ZyXEL exploitation from August 17. Public wp2shell exploits in mid-July, intrusions days later. The window between “fix available” and “fix irrelevant” is now measured in days, and state-affiliated operators are working it from a single IP range while your change-control board meets monthly.

What to actually do about it

1. Inventory your edge layer this week. Switches, APs, routers, anything with a web management interface that is not on a laptop image list. If you cannot name every device answering on an HTTP admin port, you have work to do.
2. Check for the boring failures first. 564 of 996 breached ZyXEL switches had default credentials. Exploits get the headlines; unchanged passwords hand over the keys to the ones that got patched.
3. Patch GS1900 and UniFi gear now. ZyXEL firmware from June closes CVE-2026-7273, and Ubiquiti has fixes for the three exploited UniFi OS flaws. CISA’s KEV list is a free, maintained catalogue of bugs where you should assume you were targeted.
4. Kill WAN-reachable management. A switch admin panel responding to the public internet is a breach waiting on someone’s bad Tuesday. Management belongs on an out-of-band VLAN or behind a zero-trust overlay.
5. Watch for weird traffic anyway. The GreyNoise script exfiltrates over HTTP to attacker infrastructure. Any device with no alert rule will do this for hours unnoticed. Flow records and anomaly detection are the only layer that notices.

eHawu’s take

The uncomfortable lesson of CVE-2026-7273 is that the most valuable foothold in your network may be a device no security tool covers. eHawu was built for this blind spot: network-layer protection that sits in front of every asset, patched or not, inventoried or not. Our zero-trust enforcement verifies sessions at the wire before a crafted HTTP request ever reaches a management interface, and our anomaly engine flags the exfiltration patterns that endpoint suites cannot see, because the endpoint here is a $90 switch.

For African enterprises running thin IT teams across distributed sites, the pitch is simple. You do not have to find every exposed ZyXEL box before an operator does. The network layer can hold the line while you clean up the inventory, one default password at a time.