AA26-281A
October 2026 joint advisory on Chinese government-linked hackers combining automated and manual tools.
On 8 October 2026 AA26-281A accused Integrity Technology Group, a China-based company, of enabling intrusions by government-linked hackers, and CISA put five of the advisory's flaws on a three-day federal Deadline.
Last refreshed: 12 October 2026
Why did ten agencies name a Beijing company rather than a hacking group?
Timeline for AA26-281A
Mentioned in: Ten agencies name Beijing firm in hacks
Cybersecurity: Threats and DefencesBackground
AA26-281A is a joint cybersecurity advisory released on 8 October 2026. Ten agencies from seven countries signed it: the FBI, CISA and NSA for the US, Britain's NCSC, and agencies from Australia, Canada, Japan, New Zealand and Spain. It names Integrity Technology Group, a company with links to the Chinese government, as an enabler of state-linked intrusions that mixed automated and manual tools.
The advisory says the actors' methods match those tracked as Flax Typhoon, ETHEREAL PANDA and Red Juliett. Its list of eight exploited CVEs runs from 2014 to 2023 and includes Shellshock, a Pulse Connect Secure bug and GitLab flaws. Japan's police traced the activity back to January 2016.
Five of the eight flaws were missing from CISA's Known Exploited Vulnerabilities catalogue before the advisory. CISA added all five that day and gave federal bodies until 11 October to fix them, a three-day window for weaknesses up to a decade old.