Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised

Key facts for Kapibala Red Heron campaign

Detection coverage for Kapibala Red Heron campaign

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5271 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Zyxel GS1900 Collector Retrieval — Outbound TFTP (UDP/69) to Non-Private Destinations

Detects TFTP traffic from internal devices to non-RFC1918 destinations. After exploiting GS1900 switches, Kapibala (Red Heron) used TFTP to retrieve and run a custom collector script and exfiltrate configuration, hashed root credentials and network information. Switches should never speak TFTP to the internet.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1105, T1041
• Data sources: pan:traffic, fortinet_traffic, cisco_asa, CommonSecurityLog
• Severity: high
• Confidence: high

Splunk SPL

index=network sourcetype IN ("pan:traffic","fgt_traffic","cisco:asa") ((dest_port=69 AND transport=udp) OR app=tftp)
| where NOT (cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip))
| stats count AS sessions sum(bytes_out) AS bytes_out sum(bytes_in) AS bytes_in values(dest_ip) AS tftp_servers earliest(_time) AS first_seen latest(_time) AS last_seen BY src_ip

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 69 and tolower(Protocol) in ("udp", "17")
| where not(ipv4_is_private(DestinationIP))
| summarize Sessions = count(), BytesOut = sum(SentBytes), BytesIn = sum(ReceivedBytes), TftpServers = make_set(DestinationIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DeviceVendor
| project FirstSeen, LastSeen, SourceIP, Sessions, BytesOut, BytesIn, TftpServers, DeviceVendor

Sigma

title: Outbound TFTP to Non-Private Destination (Zyxel GS1900 Kapibala Collector Retrieval)
id: a4f2c8d3-1e57-4b90-9c36-0d8e7f6a5303
status: experimental
description: Detects UDP/69 TFTP traffic to a non-private destination, used by Kapibala (Red Heron) to pull the collector script onto compromised Zyxel GS1900 switches and send back configuration data.
references:
    - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
    - https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
    - https://www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.exfiltration
    - attack.t1041
    - cve.2026.107441
logsource:
    category: firewall
detection:
    selection:
        dst_port: 69
    filter_internal:
        dst_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter_internal
falsepositives:
    - Legitimate PXE or VoIP phone provisioning against a cloud TFTP service
    - Vendor-hosted firmware retrieval
level: high

Known false positives:

• Cloud-hosted TFTP provisioning for VoIP phones or PXE
• Vendor-hosted firmware retrieval over TFTP

Tuning notes: Allowlist known provisioning servers by dest_ip. Tighten to sources in the GS1900 switch inventory for highest fidelity, and escalate when bytes_out is non-trivial (config exfiltration). Add your own private/CGNAT ranges (e.g. 100.64.0.0/10) to the exclusion.

• 🔒 Zyxel GS1900 Exploit Payload — Shell Metacharacters and Tooling Strings in Management CGI Requests · unlock with TL Creds
• 🔒 Zyxel GS1900 Collector Behaviour — Configuration and Credential File Collection in Switch Syslog · unlock with TL Creds
• 🔒 Zyxel GS1900 Exploit-to-Collector Chain — CGI Anomaly Followed by Switch-Originated TFTP · unlock with TL Creds
• 🔒 Zyxel GS1900 Mass Exploitation — External Source Probing Management CGI on Multiple Hosts · unlock with TL Creds
• 🔒 PyArmor Runtime Artifacts Written to Disk (Obfuscated Kapibala Exploit Tooling) · unlock with TL Creds
• 🔒 Zyxel GS1900 Rootkit Indicators — Kernel Module Loading in Switch Syslog (SIXZUT) · unlock with TL Creds
• 🔒 Zyxel GS1900 CVE-2026-107441 Exploit Trigger — Anomalous Management CGI Requests · unlock with TL Creds
• 🔒 Zyxel GS1900 Post-Exploitation — JITTERLY/SIXZUT Names or TFTP Fetch-and-Execute in Switch Syslog · unlock with TL Creds

Indicators of compromise for Kapibala Red Heron campaign

As of 2026-11-04, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5271.

How Kapibala Red Heron campaign works

CVE-2026-107441 is an out-of-bounds write in the CGI program of the web management interface of Zyxel GS1900 series Smart Managed Switches. Zyxel's advisory of 2026-11-03 states that a LAN-based, unauthenticated attacker can exploit it with a crafted HTTP request to potentially execute OS commands. The advisory lists ten models (GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, -48HPv2) as vulnerable at firmware 2.90(xxxx.2)C0 and earlier, with fixes at 2.90(xxxx.3)C0. No CVSS score was published; the CRITICAL severity here is analyst-assigned based on unauthenticated code execution and confirmed mass exploitation. Note that Zyxel describes the attack vector as LAN-based, while the observed campaign compromised switches in the wild at scale, so exposure of the management interface beyond the LAN should be assumed possible and verified.

The flaw is a bypass of the earlier fix for CVE-2026-7273 (a pre-authentication stack-based buffer overflow in the same CGI program, patched 2026-06-16, CVSS 8.8, added to the CISA KEV catalog on 2026-09-21). Binarly (researcher Yegor Vasilenko) analysed an exposed archive containing a PyArmor-obfuscated Python exploit used in the attacks, confirmed on 2026-09-28 that it still worked against firmware patched for CVE-2026-7273, and reported it to Zyxel on 2026-09-29. According to the BleepingComputer report, the earlier patches added overflow checks but missed validation of HTTP parameter lengths: the attacker corrupts a parameter counter before validation, which defeats the checks and enables a memory overwrite and command execution without authentication. The exploit explicitly checked for firmware versions patched for CVE-2026-7273, indicating deliberate targeting of patched devices. The exploit script exposed command-line options for targeting different firmware versions and base addresses.

GreyNoise reported that exploitation of CVE-2026-7273 began around 2026-08-17 and that a suspected Chinese-speaking actor compromised 996 switches in 48 countries (Italy, United States, Taiwan with 123 devices, France, South Korea and others), mostly in small offices, schools, hotels and retail shops. After exploitation the attacker used TFTP to retrieve and run a custom collector script and exfiltrated device configuration files, hashed root-level credentials and networking information; 564 of the devices still used factory-default credentials. BleepingComputer attributes the activity to Kapibala in the Red Heron campaign and names the JITTERLY backdoor and SIXZUT rootkit as associated malware; public technical detail on those two families was not found in the sources reviewed. GreyNoise's Red Heron cluster has also been linked in secondary reporting to WordPress exploitation (the 'WP2Shell' chain) and Gitea CVE-2026-60004. No network IOCs (IPs, domains, hashes) have been published; GreyNoise withheld the attacker IP due to victim sensitivities.

Defenders should upgrade all GS1900 switches to the .3)C0 firmware, restrict the web management interface to a dedicated management network, rotate all credentials (especially factory defaults), review switch configurations for unexpected changes, and hunt for outbound TFTP from switches and anomalous HTTP requests to the management CGI.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection; T1602.002 Network Device Configuration Dump

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information

Execution

T1059.004 Unix Shell

Initial Access

T1190 Exploit Public-Facing Application

Remediation for Kapibala Red Heron campaign

Patches

• CVE-2026-107441: update to 2.90(xxxx.3)C0 (e.g. GS1900-8 2.90(AAHH.3)C0) per Zyxel advisory 2026-11-03
• CVE-2026-7273: update to 2.90(xxxx.2)C0 or later per Zyxel advisory 2026-06-16

Immediate actions

• Upgrade all GS1900 switches to the 2.90(xxxx.3)C0 firmware listed in the Zyxel advisory of 2026-11-03
• Restrict access to the switch web management interface to a dedicated management VLAN/network and block it from untrusted networks and the internet
• Change all administrator credentials, especially factory-default ones, and treat configuration files and password hashes from exposed switches as compromised
• Block or alert on outbound TFTP (UDP/69) originating from switches

Workarounds

• Zyxel specifies no workarounds; limit management-interface reachability as a compensating control

Longer-term hardening

• Inventory GS1900 switches and track firmware versions, including those previously patched for CVE-2026-7273
• Log and review switch configuration changes and management HTTP access
• Segment small-office and branch network infrastructure from user networks

Affected and fixed versions

• Zyxel — GS1900 series Smart Managed Switches (GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48, GS1900-48HPv2)
  Vulnerable versions: GS1900-8: 2.90(AAHH.2)C0 and earlier; GS1900-8HP: 2.90(AAHI.2)C0 and earlier; GS1900-10HP: 2.90(AAZI.2)C0 and earlier; GS1900-16: 2.90(AAHJ.2)C0 and earlier; GS1900-24: 2.90(AAHL.2)C0 and earlier; GS1900-24E: 2.90(AAHK.2)C0 and earlier; GS1900-24EP: 2.90(ABTO.2)C0 and earlier; GS1900-24HPv2: 2.90(ABTP.2)C0 and earlier; GS1900-48: 2.90(AAHN.2)C0 and earlier; GS1900-48HPv2: 2.90(ABTQ.2)C0 and earlier
  Fixed in: Corresponding 2.90(xxxx.3)C0 release for each model, e.g. 2.90(AAHH.3)C0 for GS1900-8

Timeline of Kapibala Red Heron campaign

• 2026-06-16 Zyxel publishes advisory and firmware 2.90(xxxx.2)C0 fixing CVE-2026-7273, a stack-based buffer overflow in the GS1900 CGI program.
• 2026-08-17 GreyNoise observes the attacker's exploit being used against GS1900 switches; exploitation continues through mid-September.
• 2026-09-21 GreyNoise discloses compromise of 996 switches in 48 countries; CISA adds CVE-2026-7273 to the Known Exploited Vulnerabilities catalog.
• 2026-09-28 Binarly confirms the obfuscated exploit still works against firmware patched for CVE-2026-7273.
• 2026-09-29 Binarly (Yegor Vasilenko) reports the patch bypass to Zyxel.
• 2026-10-11 Zyxel confirms the new vulnerability and assigns CVE-2026-107441.
• 2026-10-22 Zyxel releases firmware updates (2.90(xxxx.3)C0) for the ten affected GS1900 models.
• 2026-11-03 Zyxel publishes the security advisory for out-of-bounds write CVE-2026-107441.
• 2026-11-04 BleepingComputer reports the zero-day, attributing activity to locked-ioc-5 (locked-ioc-3) with locked-ioc-4 backdoor and locked-ioc-8 rootkit.

Sources cited for Kapibala Red Heron campaign

• Canadian Centre for Cyber Security: Zyxel security advisory AV26-603 cyber.gc.ca · Advisory
• INCIBE-CERT early warning: CVE-2026-7273 incibe.es · Advisory
• Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches (CVE-2026-107441) zyxel.com · Vendor report · 2026-11-03
• Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches (CVE-2026-7273) zyxel.com · Vendor report · 2026-06-16
• Tenable CVE-2026-7273 Tenable · Research
• Zyxel fixes zero-day exploited to hack nearly 1,000 network switches BleepingComputer · News · 2026-11-04
• CISA orders feds to patch actively exploited Zyxel flaw by Thursday BleepingComputer · News · 2026-09-21
• Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273) Help Net Security · News · 2026-09-22
• Zyxel and Veeam flaws under active exploitation The Hacker News · News
• U.S. CISA adds Zyxel flaw to its Known Exploited Vulnerabilities catalog securityaffairs.com · News

More in vulnerability

• Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)
• Debian and Ubuntu APT Flaw (CVE-2026-109518) Lets MitM Attackers Swap Verified Packages and Run Code as Root
• Increased Scanning for Vulnerable Legacy E-Mail Test Scripts (formail/mailtest.php variants, CVE-2000-0411 lineage)
• Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads
• Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)