On 8 October 2026, CISA, FBI, NSA and international partners including Australia's ACSC published joint Cybersecurity Advisory AA26-281A on China-linked threat actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with government links that builds or acquires cyber tools, hosts infrastructure and compromises networks. Observed TTPs are consistent with activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett (vendor names may not map 1:1).

Actors combine automated scanning (including MicroScan with 1,300+ scripts), large IoT botnets, password spraying against Microsoft 365/Exchange, VPN persistence and hands-on exploitation to steal email and credentials, and have run a portal giving third parties access to stolen mail. Same day, the US Justice Department and FBI announced court-authorised seizures of seven domains used for MicroScan and FishHub spear-phishing/malware delivery; scanning targets cited in court papers include a South Carolina power company, airports in Japan and Poland, Taiwanese energy firms and universities.

Integrity Tech was previously sanctioned by the US (Jan 2025) and UK (Dec 2025); a 2024 FBI action disrupted its Raptor Train botnet.

Mitigations in the advisory include disabling unused services/ports, sanitising web inputs, MFA everywhere, and timely patching of listed n-day flaws. Primary: CISA AA26-281A (ACSC co-author); DOJ seizure PR; wire: BleepingComputer / The Hacker News.

UPDATE (11 Oct): Australia is not among the victim locations the advisory names (it lists US government, critical manufacturing, healthcare and IT organisations, plus victims in Southeast Asia, Africa and North America), but an ASD spokesperson told iTnews that "the vulnerabilities, tactics, techniques and procedures outlined in this advisory are applicable to Australian entities" and urged organisations to mitigate the threat. The other co-sealing agencies are from the UK, Canada, Japan, New Zealand and Spain.

The advisory also notes that the FBI recovered an archived email database stolen from government, law enforcement, healthcare and religious organisations in Southeast Asia, with access in some cases restricted to IP addresses in Xiamen, China; about 20 Taiwanese universities were confirmed FishHub victims; and the actors used a tool called DC.exe to run DCSync against domain controllers. Watch for unexpected Active Directory replication and replace end-of-life edge products.

Source: iTnews (12 Oct AEDT), quoting ASD.