Skip to content

Back to the catalog

Dark Web Intelligence (@DailyDarkWeb) on X
x.comthread

Dark Web Intelligence (@DailyDarkWeb) on X

A Twitter/X post digests joint advisory AA26-281A from FBI, CISA, NSA and allied agencies (UK, Australia, Canada, Japan, New Zealand, Spain) on China-based Integrity Technology Group enabling threat actors, tracked elsewhere as Flax Typhoon, Ethereal Panda and Red Juliett, to target US critical infrastructure, government, healthcare, education and law enforcement networks worldwide. The actors chain open-source scanners, large botnets, XSS, password spraying against Microsoft Exchange, VPN persistence and credential-harvesting scripts. CISA added five exploited CVEs (ISC BIND, Apache Struts, ProFTPD, ONLYOFFICE Docs, Strapi) to its KEV catalog with an Oct 11 federal remediation deadline, and STIX IOCs accompany the advisory.

TL;DR Joint US/allied advisory ties China-based Integrity Technology Group to Flax Typhoon/Ethereal Panda/Red Juliett activity and adds 5 old-but-unpatched CVEs to CISA's KEV list.
Open original ↗
Document

What it is

Joint advisory AA26-281A (FBI/CISA/NSA plus UK, Australia, Canada, Japan, New Zealand, Spain) on Integrity Technology Group, a China-based company enabling actors tracked as Flax Typhoon, Ethereal Panda and Red Juliett. The summary already covers the actors, targets, TTPs, and the five KEV-listed CVEs with the Oct 11 deadline.

What to do

The page adds a concrete analyst note and a specific official source link not in the existing summary:

  • The five KEV CVEs are deliberately old — the actors' strategy is to target unpatched, internet-facing services rather than zero-days. That's the operational takeaway: age of a CVE is not a reason to deprioritize patching it.
  • Three concrete defensive actions stated: hunt using the published STIX IOCs, disable unused services and ports, and enforce MFA.
  • Official advisory location: cisa.gov/news-events/cybersecurity-advisories/aa26-281a

Caveats

The post does not give version boundaries for the affected products (BIND, Struts, ProFTPD, ONLYOFFICE Docs, Strapi) beyond the CVE IDs themselves, nor does it detail the STIX IOC contents — both would require pulling the full advisory from the CISA link above.

Organisations named here

  • AA26-281A

CVEs named here

  • CVE-2015-5477
  • CVE-2016-3081
  • CVE-2015-3306
  • CVE-2021-3199
  • CVE-2023-22894

Technologies named here

  • ISC BIND
  • Open-source scanners
  • Apache Struts
  • Large botnets
  • ProFTPD
  • STIX IOCs
  • ONLYOFFICE Docs
  • Strapi
  • Microsoft Exchange
  • Organizations in Southeast Asia, Africa and North America

Techniques named here

  • Cross-site scripting
  • Password spraying on Microsoft Exchange
  • VPN persistence
  • Scripts that pull emails and credentials
  • Exploitation of unpatched, internet-facing services

Threat actors named here

  • Integrity Technology Group
  • Flax Typhoon
  • Ethereal Panda
  • Red Juliett

Related in Threat Intel