FBI Warns of Chinese State-Linked Hackers Exploiting Vulnerabilities at Scale On October 8, 2026, the FBI, in collaboration with CISA, the NSA, and international partners, issued a joint advisory warning of a sophisticated cyberespionage campaign linked to Chinese government-affiliated hackers. The threat actors supported by China-based Integrity Technology Group are targeting organizations across government, manufacturing, healthcare, IT, law enforcement, education, and religious institutions in Southeast Asia, Africa, and North America. The attackers employ a combination of automated vulnerability scanning, large-scale botnets, and manual exploitation to steal sensitive data. Their tactics align with activity tracked under names like Flax Typhoon, Ethereal Panda, and Red Juliett, though the advisory notes that commercial threat labels may not directly correspond to state attribution. ### Attack Methods & Tools The hackers leverage open-source scanning tools (Nmap, masscan, Fscan, dirsearch, WPScan) to identify exposed services, particularly targeting FTP, SSH, DNS, HTTP, HTTPS, and SOCKS ports. A key tool in their arsenal is MicroScan, a Python-based web application active since at least 2017, containing over 1,300 penetration-testing scripts for vulnerabilities in Oracle WebLogic, WordPress, Jenkins, Apache Struts, OpenSSL, and Juniper ScreenOS. Initial access is gained through Python/Go exploitation utilities, JavaScript XSS payloads, and credential-harvesting pages. One recovered payload, live700_v1.exe, disguised itself as DiagTrack.exe (a legitimate Windows process) and established encrypted communications with dns.studiocloud[.]xyz, likely for email data exfiltration. For password spraying, the attackers use EBurst, an open-source Python tool, against Microsoft Exchange interfaces (Outlook Web Access, Exchange Web Services, Autodiscover, PowerShell, and ActiveSync). Post-compromise, they deploy SoftEther VPN clients, often disguised as conhost.exe or dllhost.exe, to maintain persistent access while obscuring command-and-control traffic. ### Data Theft & Exfiltration The hackers employ multiple tools for data collection: - Curlc4.txt (PHP script): Interfaces with Exchange Web Services to steal emails, calendars, and contacts, compressing and encrypting them (RC4/AES-128-CBC) before exfiltration to natcloudservice[.]com. - DC.exe: Performs DCSync replication to extract Active Directory credentials and directory data. - office-cli: Automates Outlook 365 mailbox access using stolen credentials. ### Recommended Defensive Measures Authorities advise organizations to: - Disable unused services and patch exposed systems. - Sanitize web application inputs and enforce multifactor authentication. - Restrict administrative privileges and monitor for unexpected VPN installations, abnormal Active Directory replication, and unusual outbound traffic. - In case of compromise, isolate affected hosts, preserve forensic evidence, and scope compromised accounts. The advisory underscores the global reach and persistence of these state-linked cyber operations, highlighting the need for heightened vigilance across critical sectors.