Executive Summary
A joint advisory, published on 8 October 2026, from multiple international government agencies, including FBI, CISA, NSA, and NCSC-UK, details how Integrity Technology Group, a company with links to the Chinese government, enables China-linked threat actors to compromise networks and steal sensitive data from organizations worldwide. The threat actors targeted multiple U.S. critical infrastructure sectors and victims across Southeast Asia, Africa, and North America. Investigations revealed the use of large-scale botnets, VPN infrastructure, living-off-the-land (LOTL) techniques, open-source scanning tools, and custom computer network exploitation capabilities to gain and maintain access to victim environments. The actors leveraged password spraying, credential harvesting, VPN-based persistence, Active Directory replication abuse, and automated tools designed to continuously access and exfiltrate email data from both on-premises and Microsoft 365 environments. The advisory assesses that the activity is consistent with China-linked cyber operations publicly tracked as Flax Typhoon, Ethereal Panda, and Red Juliett, and urges organizations to hunt for compromises and strengthen defenses against Chinese government-linked cyber targeting.
Key Takeaways
- As early as 2017, the threat actors used a malicious Python-based web application called MicroScan, which contains more than 1,300 penetration testing scripts to scan for vulnerabilities in technologies such as OpenSSL, Oracle WebLogic, WordPress, Jenkins, Apache Struts, and Juniper ScreenOS. The actors also relied on numerous open-source reconnaissance tools, including BBScan, dirsearch, Fscan, masscan, NMAP, and wpscan, to identify vulnerable targets.
- Since at least mid-January 2021, the actors primarily gained access through command-line exploit utilities written in Python and Go, while also conducting cross-site scripting (XSS) attacks that modified webpages to harvest usernames and passwords. In observed incidents, harvested credentials led victims to download password-protected ZIP files containing malware that masqueraded as legitimate Windows processes such as DiagTrack.exe.
- The actors targeted Microsoft Exchange and Microsoft 365 environments using the EBurst tool to conduct password spraying and password guessing across interfaces including ECP, EWS, OWA, RPC, MAPI, PowerShell, Autodiscover, and Microsoft-Server-ActiveSync. Additional tooling such as office-cli automated long-term access to Outlook 365 mailboxes and facilitated continuous email collection and exfiltration.
- To establish persistence and obscure malicious activity, the threat actors routinely installed the legitimate SoftEther VPN client using PowerShell, LOTL binaries, curl, or wget, often renaming files as conhost.exe or dllhost.exe to blend in with normal Windows processes. The VPN infrastructure provided persistent remote access and supported ongoing command-and-control communications and data exfiltration.
- The FBI observed the actors collecting credentials, downloading email databases, abusing Microsoft Exchange Web Services through the Curlc4[.]txt script, and using DC.exe to execute the DCSync technique against Active Directory. Stolen data included victim emails, account credentials, group membership information, and trust relationships, with some exfiltrated data reportedly restricted to access from IP addresses located in Xiamen, China.
Indicators of Compromise
CISA has released of a large collection of Indicators of compromise associated with this campaign. Several of the observed IOCs date back to as early as 2016. The authoring organizations recommend investigating or vetting these IOCs prior to taking action, such as blocking.
