If you run Exchange, Microsoft 365, or any internet-facing web app, this advisory is worth your time. It describes a mix of automated scanning, password spraying, and quiet email theft that does not rely on anything exotic. Most of the defenses are things you can check this week.
What the advisory reports
On October 8, 2026, the FBI, CISA, NSA, and partner agencies from the UK, Australia, Canada, Japan, New Zealand, and Spain published a joint advisory. It focuses on Integrity Technology Group, a China-based for-profit company with links to the Chinese government, and the threat actors it enables.
According to the advisory, Integrity Tech staff acquire or build tools, acquire and host infrastructure, and compromise networks. The activity overlaps with what the public knows as Flax Typhoon, Ethereal Panda, and Red Juliett. The advisory also cautions that vendors track these groups differently, so the mapping is not one-to-one.
Targets included US critical infrastructure (government services, critical manufacturing, healthcare, and IT), plus law enforcement, education, and religious organizations. Victims were also found in Southeast Asia, Africa, and North America. The findings come from technical evidence in multiple FBI investigations.
How the activity works
Reconnaissance. The actors use open source scanners such as BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan. They focus on ports 21, 22, 53, 80, 443, and 1080. They have also used a Python web application called MicroScan since as early as 2017, which bundles over 1,300 scripts that check sites for specific vulnerabilities.
Initial access. Since at least mid-January 2021, they have mostly used command-line exploit tools written in Python and Go. They also use cross-site scripting. One recovered XSS payload injects username and password fields into a vulnerable page. After a user submits credentials, it offers a password-protected zip containing live700_v1.exe. That file starts a process named DiagTrack.exe, which borrows its name from legitimate Windows software, and it contacts a domain the FBI attributes to Integrity Tech. The FBI assesses it likely targets mailbox data.
Password attacks. They use EBurst, an open source Python tool, to spray and guess passwords against Exchange. The advisory lists the interfaces it hits: ECP, EWS, OAB, OWA, RPC, API, MAPI, PowerShell, Autodiscover, and ActiveSync.
Persistence. They install SoftEther VPN clients on victim devices, pulling installers down with PowerShell, curl, or wget. The clients reconnect automatically on startup, and the installers are often named conhost.exe or dllhost.exe. The advisory notes that endpoint detection is less likely to flag SoftEther because it is legitimate software.
Collection and exfiltration. The FBI saw a PHP bot, Curlc4.txt, that talks to the Microsoft EWS API to pull email, compress it, and sometimes encrypt it with RC4 or AES-128-CBC before upload. A tool called DC.exe performed DCSync against Active Directory to copy credentials, group memberships, and trust relationships. A command-line utility, office-cli, repeatedly accesses Outlook 365 mailboxes using configuration files containing a client ID, tenant ID, and secret. The advisory says the actors evade detection there by using legitimate access methods. They also run a custom web app that gives third parties access to the stolen email.
My take
Everything below this heading is my analysis, not the advisory’s.
The thing that stands out to me is how ordinary the toolkit is. Public scanners, a public password-spraying tool, a legitimate VPN client, and standard Microsoft APIs. None of it needs a zero-day. That is good news in one sense, because boring defenses work against boring attacks.
The harder part is that several steps look like normal activity. SoftEther is real software. An application with a valid client ID and secret reading mailboxes through the official API looks a lot like a backup or archiving product. Signature-based detection will struggle with that. You need to know what normal looks like in your tenant.
The focus on email also tells me something. Mailboxes hold credentials, password resets, contracts, and a map of who talks to whom. If I were an attacker collecting data at scale, I would go there first too.
What I would do first
These are drawn from the advisory’s mitigation list, with my ordering.
- Require MFA on webmail and VPNs. The advisory specifically calls out webmail, VPNs, and accounts that reach critical systems. Password spraying against Exchange interfaces is the cheapest attack here, and MFA blunts it.
- Audit which Exchange interfaces are exposed. Given the EBurst interface list, check whether ECP, EWS, OAB, RPC, MAPI, PowerShell, Autodiscover, and ActiveSync need to be reachable from the internet at all. The advisory also says to disable unused services and ports.
- Review connected apps in your cloud tenant. The advisory recommends monitoring cloud accounts for connected applications that can access email and file data. Look for apps with mailbox access that nobody can explain, and check how their secrets are stored.
- Watch for unexpected Active Directory replication. DCSync from anything other than a domain controller is a strong signal. The advisory calls out unexpected AD replication and LOTL tool misuse as things to monitor.
- Hunt for SoftEther. Search endpoints for VPN clients nobody deployed, especially binaries named conhost.exe or dllhost.exe running from odd paths. Check outbound connections too.
- Sanitize input in your web apps. The XSS payload in this advisory harvests credentials by rewriting a page. Input sanitization is the stated fix, and the advisory points to CISA and OWASP guidance.
- Check outbound volume. The advisory suggests monitoring for high outbound or upload traffic from devices that normally upload little.
- Patch and shrink your exposure. MicroScan targets well-known products including WebLogic, Jenkins, Struts, and WordPress. An attack surface scan of your own perimeter tells you what these actors would see.
Using the indicators carefully
The advisory includes a long list of domains and IP indicators. It warns that several date back as early as 2016 and should be investigated or vetted before you block them. I would use them for retrospective hunting in DNS and proxy logs first, not as a blocklist dropped in without review.
It also recommends validating your controls against the ATT&CK techniques it maps. Pick one, such as password spraying against Exchange or DCSync, run it in a test setting, and see whether your tooling alerts. If it does not, you have found a gap before someone else does.
If you find something
The advisory’s incident response steps are straightforward. Isolate affected hosts, hunt to scope the intrusion, and collect logs before you evict. Report according to your national guidance, then harden. For US organizations, that means the FBI, CISA, or NSA.
The short version: turn on MFA, trim your Exchange exposure, look at who has mailbox access in your cloud tenant, and hunt for VPN clients you did not install.
Sources
- Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data — All CISA Advisories, 2026-10-08
