CISA advisory ties China-linked Integrity Tech to automated plus hands-on data theft

CISA, the FBI, NSA and allied agencies published a joint advisory on October 8, 2026, describing Chinese government-linked cyber threat actors who combine automated scanning tools with hands-on intrusion to steal sensitive data. The advisory, assigned alert code AA26-281A, states these actors are enabled by a China-based company called Integrity Technology Group.

What happened

Integrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit US and foreign organization networks across multiple sectors using various tools and techniques.

The advisory links the enabled actors' tactics to activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett, among others.

According to the advisory, these actors exploit vulnerabilities using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts.

Reconnaissance relies on open source scanning tools including BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan.

The advisory was co-authored by the FBI, CISA, NSA, the UK National Cyber Security Centre, Australia's ACSC, and Canada's Cyber Centre, among other allied agencies.

Impact

Victims span multiple US critical infrastructure sectors, including Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology.

The actors also targeted victims in US law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, and North America.

The advisory lists affected products tied to eight CVEs spanning multiple vendors and years.

Response

The authoring agencies recommend organizations prioritize disabling unused services and ports, sanitizing web application inputs, implementing multifactor authentication for all services, and applying timely patches.

Australia's Cyber Security Centre advises organizations to review their systems for signs of compromise using the indicators of compromise and threat activity described in the advisory.

Lessons for security leaders

The advisory shows that Chinese government-linked campaigns rely on a mix of commodity open-source scanners and hands-on exploitation rather than a single novel tool, so defenders should hunt across both automated and manual indicators rather than assuming one detection layer is sufficient. Several of the exploited CVEs date back more than a decade, underscoring the value of inventorying internet-facing Exchange, VPN, and web infrastructure and closing long-standing patch gaps. Because persistence was established through VPN software and password spraying against Exchange, enforcing multifactor authentication on remote access and mail services, and sanitizing web inputs against cross-site scripting, map directly to the mitigations the authoring agencies published.