A ransomware group has been observed exploiting a recently patched command injection vulnerability in Zyxel firewalls for initial access.