How to Recover a Managed Switch After Its Config and Root Hash Were Stolen

The attacker behind the August 2026 campaign against Zyxel GS1900 switches did not install ransomware or build a botnetBotnet🛡️A network of internet-connected devices compromised and controlled by an operator, used for denial-of-service attacks, proxying malicious traffic, credential stuffing or spam. Edge routers are prized botnet hosts because they are numerous, always on, directly reachable and rarely inspected by their owners.. According to GreyNoise, the exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. for CVE-2026-7273 pulled each device's configuration, its networking information and its hashed root credential, staged the bundle where the switch's own web server would hand it over, and moved on. That makes recovery deceptively simple to describe and easy to get wrong: the switch will keep passing frames perfectly well, and nothing in its behavior tells you that a copy of its brain is now on someone else's server.

This guide covers what to do when a managed switch's configuration has been exfiltrated, whether through this vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. or any other pre-authentication management-interface bug.

Decide Who Is in Scope

Do not limit the response to devices with confirmed indicators. The Zyxel exploit left its output in a temporary file and a web-served directory, and a competent operator can clean both. Scope should be based on exposure, not evidence: any affected model, running vulnerable firmwareFirmware🏠Permanent software programmed into a device's hardware that controls its basic functions., whose management interface was reachable from wherever the attacker was during the exploitation window, is treated as compromised.

For the GS1900 campaign that window opens on or about 17 August 2026 and does not close until the device was patched to the fixed .2)C0 build or its interface was taken off the reachable network. Establishing that requires firmware version history and knowledge of what the management interface could be reached from, which most small networks do not have written down. When in doubt, the device is in scope.

Understand What Was Taken

A switch configuration is not just a list of port settings. Depending on what was enabled, it can contain the local administrator credential (as a hash on this platform), SNMP community strings that grant read or write access to the device, the addresses and shared secrets for RADIUSRADIUS🌐Remote Authentication Dial-In User Service, the protocol network devices use to ask a central server whether a user or device should be granted access and with what attributes. Each device shares a secret with the server, so a compromised server exposes the secrets of every device that trusts it. or TACACS+TACACS+🌐A Cisco-originated protocol for device administration that authenticates engineers logging into network equipment and authorizes each command they run, with per-session accounting. It is typically served by the same policy server as RADIUS, making that server the authority over who can configure the network. authentication servers, syslog and NTP server addresses, the management IP and VLAN layout, port-to-VLAN assignments, link aggregation groups and any access control lists. The networking information adds the device's view of its neighbors: which addresses live behind which ports.

Sort those into three buckets. Secrets that must be rotated: every password, community string and shared secret in the file. Structural information the attacker now holds and cannot be taken back: VLAN design, addressing, which port leads to the server rack. Credentials that may be reused elsewhere: an admin password that also opens the firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules., the wireless controller or the ISP routerRouter🌐A device that directs data packets between your local network and the internet., which is common on small networks with one administrator.

The hashed root credential deserves specific attention. A hash is not a password, but it is a password waiting to be cracked offline with no lockout and no logging. GreyNoise found that 564 of the 996 compromised switches were still using factory default credentialsDefault Credentials🛡️Passwords, keys, or secrets that ship with software or are silently generated when an operator does not set them. Deployments that never replace these values are open to anyone who reads the documentation or derives the fallback — one of the oldest persistent authentication failure classes., which means no cracking was needed at all. If the password was short, reused or default, assume it is known.

Rotate Every Secret the Config Contained

Start with the switch administrator credential and rotate it on the switch and on every other system where the same password was used. On small networks the honest answer to "where else is this used" is often "everywhere," so treat this as an audit, not a single change.

Rotate SNMP community strings on the switch and update every monitoring system that polls it. A write community string in an attacker's hands is remote configuration access without needing the vulnerability again. If SNMP is version 1 or 2c, this is a good moment to move to version 3 with authentication and encryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key., or to disable it where nothing actually polls the device.

Rotate RADIUS and TACACS+ shared secrets on the authentication server and on every network device that uses them. This is the change most often skipped, because the secret lives in two places and the second one is not the compromised switch. An attacker with the shared secret can impersonate the switch to the authentication server or read the exchange between them.

Verify that syslog, NTP and any management-station addresses in the config are ones you recognize. An attacker who could read the config could also have written it; check for additions such as a new admin account, a new SNMP community, a new management address, a mirror or SPAN session pointing at a port they control, or an access list that was loosened.

Reflash and Rebuild the Device

Patching a compromised device in place closes the hole the attacker came through and does nothing about anything they left behind. The Zyxel exploit demonstrated arbitrary command execution as the operating system, which means it could have modified anything on the filesystem, not just the configuration.

The defensible sequence is: export the current configuration for forensic reference, note the running firmware version, factory reset the device, install the fixed firmware, and rebuild the configuration by hand or from a known-good backup taken before the exploitation window. Applying a config backup taken after 17 August restores whatever the attacker changed along with everything else. If no clean backup exists, rebuild from documentation and use the exported compromised config only as a checklist of what settings existed.

Do this before the device is reconnected to a network the attacker could reach. A freshly reset switch with default credentials on an exposed interface is exactly the state more than half of the original victims were in.

Fix the Exposure That Made It Possible

Recovery is incomplete if the management interface goes back to where it was. Move management onto a dedicated VLAN, restrict it with an access list to an administrative subnet or jump host, and verify from outside the network that no management port answers on any public address. Why a "LAN-only" CVSS rating does not mean the internet cannot reach it explains why this step, not the patch, is what separates the devices that were swept up in this campaign from the ones that were not.

Add the indicators GreyNoise published to outbound blocking and alerting: the staging host 74.48.66.73, the domain pattern *.981666.xyz, and the addresses 104.225.153.141 and 172.245.247.21. More durably, alert on any outbound TFTP or HTTP from a switch management address to the internet. Switches have no reason to initiate those connections, and the Zyxel payload depended on exactly that.

Plan for the Next Time

The structural information the attacker took does not expire. Someone now holds a map of the network's VLANs, addressing and the identity of the hosts behind each port, and that map stays accurate until the network changes. That is not a reason to redesign the network in a panic, but it is a reason to treat any later intrusion attempt against the addresses in that config with more suspicion than usual, and to make sure nothing else on the network is protected only by obscurity.

It is also a reason to fold devices like this into a real patch and inventory process. The GS1900 fix was available for two months before the harvesting run. Why small-business switches are the forgotten tier of firmware patching covers how to make sure the next advisory for a device like this reaches someone who will act on it.