5SEP

Ten agencies name Beijing firm in hacks

3 min read

12:09UTC

Ten agencies from seven countries named Integrity Technology Group on 8 October, and CISA turned five old flaws from the advisory into three-day federal deadlines the same day.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyAssessed

Key takeaway

A seven-country attribution on 8 October set three-day federal deadlines for five flaws as old as 2015.

Ten agencies from seven countries published joint advisory AA26-281A on 8 October, naming Integrity Technology Group, a for-profit Beijing company, as an enabler of Chinese government-linked intrusions⁠¹. The US signed through the Federal Bureau of Investigation (FBI), the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA). Britain's National Cyber Security Centre (NCSC) published the UK side the same day⁠², and agencies from Australia, Canada, Japan, New Zealand and Spain, through its National Intelligence Centre, completed the list. The advisory says the actors' methods match Flax Typhoon, also tracked as ETHEREAL PANDA and Red Juliett, and draws on several FBI investigations.

CISA added five flaws dated 2015 to 2023 to its Known Exploited Vulnerabilities (KEV) catalogue the same day, the list of bugs it has confirmed attackers are using, each with a federal deadline of 11 October⁠³. Each flaw carries a CVE (Common Vulnerabilities and Exposures) identifier: BIND name-server CVE-2015-5477, ProFTPD CVE-2015-3306, Apache Struts CVE-2016-3081, ONLYOFFICE Docs CVE-2021-3199 and Strapi CVE-2023-22894. Those five are exactly the advisory CVEs the catalogue did not already hold; Shellshock, Pulse Secure and GitLab were listed before.

Sixteen agencies had named the same company, with Flax Typhoon, over a router botnet in April. This time the attribution and the patch deadlines arrived together, so a federal agency running any of the five components took its deadline from an intelligence finding rather than a vendor bulletin.

Japan's National Police Agency (NPA) and National Cybersecurity Office published the Japanese release on 9 October⁠⁴. It names the SoftEther virtual private network (VPN) client, a scanner called "MicroScan" and a Linux binary called "office-cli", with indicators of compromise going back to January 2016. According to the release, the actors relied on open-source scanners, password spraying against Microsoft Exchange Server, and a commercial VPN installed with PowerShell so access survived a reboot.

Deep Analysis

In plain English

Ten government security agencies, from the US, UK, Japan, Australia, Canada, New Zealand and Spain, published a joint warning about a Beijing company called Integrity Technology Group. They say it helps hacking groups linked to the Chinese government break into organisations around the world. The hackers did not need clever new tricks. They scanned the internet for servers running old, unpatched software and tried common passwords against email systems. The US Cybersecurity and Infrastructure Security Agency (CISA) keeps a list of software flaws that attackers are known to use. It added five of the flaws named in the warning to that list and told US government bodies to fix them within three days.

Deep Analysis

Root Causes

China's 2021 Regulations on the Management of Security Vulnerabilities require network product providers to report flaws in their own products to the Ministry of Industry and Information Technology within two days. That rule gives state-linked contractors early sight of bug knowledge before vendors ship fixes.

The attackers' tool list (Fscan, masscan, password spraying against Microsoft Exchange) only works where internet-facing servers still run components from a decade ago. BIND and ProFTPD survive inside appliances whose makers stopped shipping firmware, so their owners cannot patch even when told to.

Buying intrusion capacity from a for-profit firm lets a state agency scale without hiring. The indicators dating to January 2016 show one contractor sustaining the same operation for ten years.

What could happen next?

Precedent
CISA can now turn a named-actor advisory into same-day federal patch orders, tying deadlines to intelligence findings rather than vendor bulletins.
Short term · Assessed
Risk
Appliances embedding unsupported BIND or ProFTPD builds cannot be patched, so some federal owners will have to pull hardware offline to comply.
Immediate · Suggested
Consequence
Japan publishing the advisory in its own language widens the coalition beyond the Five Eyes and raises the diplomatic cost for Beijing of dismissing it.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In March 2025 the US Justice Department charged 12 Chinese contract hackers, including staff of the Shanghai firm i-Soon, after a 2024 leak of i-Soon documents showed it selling intrusions to Chinese ministries. The charges mapped the hacking-for-hire market but produced no extraditions, which is the likely ceiling for this advisory too.

Counter-parallel: After the September 2015 agreement between Barack Obama and Xi Jinping against commercial cyber theft, FireEye reported a sharp fall in China-based intrusions against US companies. A bilateral deal moved behaviour where naming alone had not, and neither 8 October release mentions any such channel.

The five listed flaws sit mostly inside third-party products, so the immediate cost falls on vendors who must rebuild firmware with current BIND, ProFTPD or Struts libraries, and on federal Teams auditing which appliances embed them.

For kit past end of support no firmware will come. Its owners face a capital purchase rather than a patch, and the three-day federal window gives no budget cycle in which to make it.

Consensus view: The FBI built the evidence from several criminal investigations into Integrity Technology Group, not from signals intercepts, which is why ten agencies could sign a company name rather than a cluster label. Japan's National Police Agency then added its own tool list and indicators reaching back to January 2016, turning a US case file into an East Asian finding, a step past the April botnet naming.

Counter-view: China's National Computer Virus Emergency Response Center argued in 2024 reports that the Volt Typhoon attribution was a US fabrication built on indicators any third party could plant. Beijing has rejected each Western naming of a Chinese contractor on the same grounds, and nothing in the Japanese or US releases answers that challenge with public forensic detail.

Key tension: Whether naming a commercial contractor raises the cost of hacking-for-hire for Beijing, or simply moves the work to a firm nobody has named yet.

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

Sixteen cyber agencies name Flax Typhoon network

The April naming of Integrity Technology Group over the Flax Typhoon botnet preceded the October advisory naming it again.

Occurred 23 Apr 2026

Read story →

This Event

Ten agencies name Beijing firm in hacks

An intelligence attribution set US federal patch deadlines directly, with no vendor bulletin in between.

Led to

Six agencies tie SafePay to old flaws

Unlike the 8 October China advisory, the SafePay advisory named only flaws already in KEV and set no new deadlines.

Occurred 20 Oct 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.