12OCT

Ten agencies name Beijing firm in hacks

3 min read

10:55UTC

Ten agencies from seven countries named Integrity Technology Group on 8 October, and CISA turned five old flaws from the advisory into three-day federal deadlines the same day.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

A seven-country attribution on 8 October set three-day federal deadlines for five flaws as old as 2015.

Ten agencies from seven countries published joint advisory AA26-281A on 8 October, naming Integrity Technology Group, a for-profit Beijing company, as an enabler of Chinese government-linked intrusions⁠¹. The US signed through the Federal Bureau of Investigation (FBI), the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA). Britain's National Cyber Security Centre (NCSC) published the UK side the same day⁠², and agencies from Australia, Canada, Japan, New Zealand and Spain, through its National Intelligence Centre, completed the list. The advisory says the actors' methods match Flax Typhoon, also tracked as ETHEREAL PANDA and Red Juliett, and draws on several FBI investigations.

CISA added five flaws dated 2015 to 2023 to its Known Exploited Vulnerabilities (KEV) catalogue the same day, the list of bugs it has confirmed attackers are using, each with a federal deadline of 11 October⁠³. Each flaw carries a CVE (Common Vulnerabilities and Exposures) identifier: BIND name-server CVE-2015-5477, ProFTPD CVE-2015-3306, Apache Struts CVE-2016-3081, ONLYOFFICE Docs CVE-2021-3199 and Strapi CVE-2023-22894. Those five are exactly the advisory CVEs the catalogue did not already hold; Shellshock, Pulse Secure and GitLab were listed before.

Sixteen agencies had named the same company, with Flax Typhoon, over a router botnet in April. This time the attribution and the patch deadlines arrived together, so a federal agency running any of the five components took its deadline from an intelligence finding rather than a vendor bulletin.

Japan's National Police Agency (NPA) and National Cybersecurity Office published the Japanese release on 9 October⁠⁴. It names the SoftEther virtual private network (VPN) client, a scanner called "MicroScan" and a Linux binary called "office-cli", with indicators of compromise going back to January 2016. According to the release, the actors relied on open-source scanners, password spraying against Microsoft Exchange Server, and a commercial VPN installed with PowerShell so access survived a reboot.

Deep Analysis

In plain English

Ten government security agencies, from the US, UK, Japan, Australia, Canada, New Zealand and Spain, published a joint warning about a Beijing company called Integrity Technology Group. They say it helps hacking groups linked to the Chinese government break into organisations around the world. The hackers did not need clever new tricks. They scanned the internet for servers running old, unpatched software and tried common passwords against email systems. The US Cybersecurity and Infrastructure Security Agency (CISA) keeps a list of software flaws that attackers are known to use. It added five of the flaws named in the warning to that list and told US government bodies to fix them within three days.

Deep Analysis

Root Causes

China's 2021 Regulations on the Management of Security Vulnerabilities require network product providers to report flaws in their own products to the Ministry of Industry and Information Technology within two days. That rule gives state-linked contractors early sight of bug knowledge before vendors ship fixes.

The attackers' tool list (Fscan, masscan, password spraying against Microsoft Exchange) only works where internet-facing servers still run components from a decade ago. BIND and ProFTPD survive inside appliances whose makers stopped shipping firmware, so their owners cannot patch even when told to.

Buying intrusion capacity from a for-profit firm lets a state agency scale without hiring. The indicators dating to January 2016 show one contractor sustaining the same operation for ten years.

What could happen next?

Precedent
CISA can now turn a named-actor advisory into same-day federal patch orders, tying deadlines to intelligence findings rather than vendor bulletins.
Short term · Assessed
Risk
Appliances embedding unsupported BIND or ProFTPD builds cannot be patched, so some federal owners will have to pull hardware offline to comply.
Immediate · Suggested
Consequence
Japan publishing the advisory in its own language widens the coalition beyond the Five Eyes and raises the diplomatic cost for Beijing of dismissing it.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In March 2025 the US Justice Department charged 12 Chinese contract hackers, including staff of the Shanghai firm i-Soon, after a 2024 leak of i-Soon documents showed it selling intrusions to Chinese ministries. The charges mapped the hacking-for-hire market but produced no extraditions, which is the likely ceiling for this advisory too.

Counter-parallel: After the September 2015 agreement between Barack Obama and Xi Jinping against commercial cyber theft, FireEye reported a sharp fall in China-based intrusions against US companies. A bilateral deal moved behaviour where naming alone had not, and neither 8 October release mentions any such channel.

The five listed flaws sit mostly inside third-party products, so the immediate cost falls on vendors who must rebuild firmware with current BIND, ProFTPD or Struts libraries, and on federal Teams auditing which appliances embed them.

For kit past end of support no firmware will come. Its owners face a capital purchase rather than a patch, and the three-day federal window gives no budget cycle in which to make it.

Consensus view: The FBI built the evidence from several criminal investigations into Integrity Technology Group, not from signals intercepts, which is why ten agencies could sign a company name rather than a cluster label. Japan's National Police Agency then added its own tool list and indicators reaching back to January 2016, turning a US case file into an East Asian finding, a step past the April botnet naming.

Counter-view: China's National Computer Virus Emergency Response Center argued in 2024 reports that the Volt Typhoon attribution was a US fabrication built on indicators any third party could plant. Beijing has rejected each Western naming of a Chinese contractor on the same grounds, and nothing in the Japanese or US releases answers that challenge with public forensic detail.

Key tension: Whether naming a commercial contractor raises the cost of hacking-for-hire for Beijing, or simply moves the work to a firm nobody has named yet.

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

Sixteen cyber agencies name Flax Typhoon network

The April naming of Integrity Technology Group over the Flax Typhoon botnet preceded the October advisory naming it again.

Occurred 23 Apr 2026

Read story →

This Event

Ten agencies name Beijing firm in hacks

An intelligence attribution set US federal patch deadlines directly, with no vendor bulletin in between.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.