AA26-281A: Chinese-linked actors, Integrity Tech, and old CVEs

On 8 October 2026, the FBI, CISA, NSA and partner agencies from the UK, Australia, Canada, Japan, New Zealand and Spain published joint advisory AA26-281A, titled "Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data." The advisory describes the actors as Chinese government-linked and says they are enabled by Integrity Technology Group, which it calls a China-based company with links to the Chinese government.

This post sticks to what the advisory says. It is a good read for anyone who runs web applications, Exchange or Microsoft 365, or VPN gear, because most of the entry points it lists are old and fixable.

What happened

According to the advisory, the information comes from multiple FBI investigations. The authoring agencies are the FBI, CISA, NSA, the UK NCSC, Australia's ACSC, Canada's Cyber Centre, Japan's NPA and NCO, New Zealand's NCSC-NZ and Spain's CNI.

The advisory says Integrity Tech acquires or builds cyber tools, acquires and hosts infrastructure, and compromises networks. It says the tradecraft is consistent with activity that vendors publicly track as Flax Typhoon, Ethereal Panda and Red Juliett, among others, and it cautions that vendor tracking names may not map one to one to the US government's own understanding. We use the advisory's wording and do not go beyond it.

Targets named in the advisory:

• US critical infrastructure sectors: Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology.
• Other US targets: law enforcement, education and religious organizations.
• Regions: Southeast Asia, Africa and North America.
• Email theft victims in Southeast Asia: government, law enforcement, healthcare and religious institutions.

Techniques described

The advisory maps activity to MITRE ATT&CK and describes a chain of mostly commodity tooling:

1. Scanning. Open source scanners such as BBScan, dirsearch, Fscan, masscan, NMAP, OneForAll, ShuiZe and wpscan, plus a Python web application called MicroScan, in use since 2017, with over 1,300 penetration testing scripts aimed at products such as OpenSSL, Oracle WebLogic, WordPress, Jenkins and Apache Struts.
2. Initial access. Exploit code in Python and Go, and cross-site scripting. One XSS payload shows fake username and password fields, then offers a password-protected ZIP containing an executable that masquerades as DiagTrack.exe. The advisory dates this activity to at least mid-January 2021.
3. Password attacks. EBurst, an open source Python tool, for spraying and guessing against Exchange and Office 365 endpoints.
4. Persistence. SoftEther VPN clients, configured to reconnect on startup and often named conhost.exe or dllhost.exe.
5. Credential access. A DCSync tool that copies Active Directory credentials and trust data through directory replication.
6. Collection and exfiltration. A PHP script that uses the Exchange Web Services API to pull mail, staged under innocuous file names, and a Linux binary that keeps access to Office 365 mailboxes using tenant and client configuration. The advisory says emails were uploaded automatically to remote servers.

Vulnerabilities the advisory says were exploited

You can look any of them up on Gold, for example CVE-2016-3081, CVE-2019-11510, CVE-2021-22205 and CVE-2023-22894.

Confirmed, reported and unknown

Stated by the agencies in the advisory: the attribution to Chinese government-linked actors enabled by Integrity Tech, the target sectors, the tools, the CVEs and the indicators.

Not stated in the advisory text we reviewed: how many organizations were compromised, which specific victims lost which data, and any financial impact. We do not give figures, because the advisory does not.

Unknown to us: whether your own environment was touched. The advisory warns that many of its indicators date from 2019 to 2024 and should be vetted before blocking, since some domains have since expired and been re-registered.

Why it matters

Nothing on the CVE list is new. The newest is from 2023 and the oldest from 2014. The lesson is not about a novel exploit. It is that automated scanning finds the one forgotten server, and a person then takes over from there.

Mailbox theft also bypasses most of what teams watch for. A stolen Office 365 client secret or a password sprayed against a legacy Exchange endpoint looks like normal mail traffic. Edge devices, internal GitLab or Jenkins servers and old document servers rarely sit in anyone's patch dashboard.

What to do now

1. Search your asset inventory for the products in the table, including internal GitLab, Strapi, ONLYOFFICE, Struts and Pulse Connect Secure. Anything found should be patched, replaced or removed.
2. Check mailbox and tenant logs for password spraying across Exchange endpoints such as OWA, EWS, Autodiscover and ActiveSync, and for new app registrations or client secrets you did not create.
3. Hunt for the behaviors the advisory lists: SoftEther installs, services named conhost.exe or dllhost.exe running from odd paths, and unexpected Active Directory replication requests from non domain controllers.
4. Require MFA on webmail, VPN and administrator accounts, as the advisory recommends.
5. Review outbound uploads and DNS from servers that should rarely talk to the internet. The advisory recommends protective DNS and monitoring of outbound traffic.
6. Vet the published indicators from the STIX files on the advisory page before blocking, using the age caveat above.
7. If you find signs of compromise, follow the CISA resources the advisory points to, including the Eviction Strategies Tool.

How this could have been avoided

• Patching and retiring end of life products. Every CVE in the table has had a fix or a retirement path for years. A tracked inventory with owners would have flagged them.
• Reducing internet exposure. MicroScan and the open source scanners work by finding exposed services on a short list of ports. Closing unused services, which the advisory lists as a key action, removes targets.
• Input sanitization. The advisory names sanitizing user input as a key action because XSS was used to collect credentials.
• MFA and disabling legacy mail protocols. Password spraying against Exchange endpoints fails against accounts that require MFA and do not accept basic authentication.
• Detecting directory replication from the wrong place. DCSync is noisy if you alert on replication requests that do not come from domain controllers.

Try it yourself

Pick one internet facing system and write down its owner, product, version and last patch date. If you cannot do that in five minutes, you have found the gap this advisory exploits. The demo below shows a discovery view.

Click through it at your own pace, or open it full screen.

You can also drop a package.json or SBOM into the free scan at https://gold.safeguard.sh/scan. It runs in your browser and the file does not leave your machine. It covers application dependencies, not Exchange or VPN appliances.

Quick check

Sources

• CISA, AA26-281A, Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data, 8 October 2026