CISA AA26-281A: Chinese Government-linked Actors Combine Automated and Hands-on Hacking Tools to Steal Data

What it is

A joint advisory (FBI, CISA, NSA, NCSC-UK, ASD's ACSC, Canada's Cyber Centre, Japan's NPA/NCO, NCSC-NZ, Spain's CNI) first published October 8, 2026. It attributes enabling infrastructure and tooling to Integrity Technology Group, a China-based company with government links. The activity is consistent with Flax Typhoon, Ethereal Panda and Red Juliett, though the advisory says vendor groupings may not map 1:1 to the US Government's. The evidence comes from multiple FBI investigations. Targets include US government, critical manufacturing, healthcare, IT, law enforcement, education and religious organizations, plus victims in Southeast Asia, Africa and North America.

How it works

The chain below is described in the advisory. The details worth hunting on are these:

• Recon: open-source scanners (BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, wpscan). They focus on ports 21, 22, 53, 80, 443 and 1080, and use dirsearch to enumerate PHP and ASP pages. MicroScan is a Python web app with over 1,300 vulnerability-check scripts, in use since at least 2017.
• XSS lure: the payload injects username and password fields into a vulnerable page. After the user submits anything, it offers a password-protected .zip containing live700_v1.exe. That executable launches a process named DiagTrack.exe (a legitimate Windows name), which talks encrypted HTTP to dns.studiocloud.xyz and has mailbox-query functions.
• EBurst: password spraying and guessing against Exchange interfaces: ECP, EWS, OAB, OWA, RPC, API, MAPI, PowerShell, Autodiscover and ActiveSync. The advisory says defenders should cover all of them.
• Persistence: SoftEther VPN client, fetched via PowerShell/LOTL binaries on Windows or curl/wget on Linux. It is set to auto-reconnect and often named conhost.exe or dllhost.exe.
• Credential theft: DC.exe performs DCSync over an RPC binding to the domain controller.
• Mail theft:
• Curlc4.txt: a stand-alone PHP bot using EWS. It compresses mail and optionally encrypts it with RC4 or AES-128-CBC. It renames its child process crypto and sends an X-Id header.
• office-cli: uses client_id, tenant_id and secret in JSON files in a config directory. It writes output under dump, and the access is legitimate API use.
• Stolen mail was served through a custom web app, and in some cases access to the exfiltrated data was restricted to Xiamen IP addresses.

What to do

Hunt for these concrete artifacts:

• SoftEther hosts: 98aiblog[.]com, hmbcloud[.]com, hmbcloud[.]net, hmbiplc-01[.]com, iepl.node[.]cm, javacheck.ooguy[.]com, javaupdate.giize[.]com, sexytube0[.]com, twimg.co[.]uk.
• Curlc4 C2: natcloudservice[.]com, upl.natcloudservice[.]com, IP 149.28.132[.]137, paths /ews.
• Curlc4 host artifacts: /var/tmp/.sess.zip, .run, storage/fm, clientid and cp files in the run directory.
• Staging names: 001.gif, All_scanner_vXX.pl.gz, Css.js, Include.png, M2k.js, M2k_list.js, M2k_ui_adm.js.
• Other: dns.studiocloud.xyz, live700_v1.exe and DiagTrack.exe outside normal Windows paths, and conhost.exe/dllhost.exe that are actually SoftEther.
• AD: alert on unexpected directory replication (DCSync) from non-DC hosts.
• Cloud: audit OAuth/app registrations with mailbox access, since office-cli abuses app credentials.

Mitigations the advisory states:

• Sanitize input to block XSS.
• Require MFA, especially on webmail and VPNs.
• Disable unused services and reduce internet exposure.
• Enable protective DNS and download reputation screening.
• Segment the network.
• Review web logs for traversal, command injection and enumeration.
• Monitor for high outbound uploads from low-upload hosts.
• Patch the CVEs in Appendix B (which includes newly KEV-added entries).

For eviction, collect enough hunt data first, then build a plan with CISA's Playbook-NG and COUN7ER. The advisory also recommends testing your controls against the ATT&CK techniques it lists.

Caveats

• Several IOCs date back to 2016. The advisory says to vet them before blocking.
• The IOC tables, CVE table (Table 16) and ATT&CK tables are not in the fetched text, so CVE IDs are not reproduced here. Pull them from the page or its downloadable IOC file.
• Integrity Tech-enabled actors may also perform activity unrelated to the company.
• Scanning tools and SoftEther are legitimate or open-source, so detections need context. The advisory notes that endpoint tools are less likely to flag SoftEther.