Ten agencies, including Spain's CNI, detail how the Chinese cyber-espionage network backed by Integrity Technology Group operates

Joint advisory AA26-281A describes how actors linked to the Chinese Government combine mass scanning, botnets and email theft on Exchange and Microsoft 365. It includes indicators and the exploited CVEs.

October 8, 2026

Curated High

Source CISA - Cybersecurity and Infrastructure Security Agency

By CISA (joint advisory with FBI, NSA, CNI and other allied agencies)

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

Published on 8 October 2026

Ten agencies from six countries, with Spain's CNI among them, attribute to a Chinese company with government ties the support of email and credential theft campaigns. The advisory provides techniques, indicators of compromise and exploited vulnerabilities.

Read the original on CISA - Cybersecurity and Infrastructure Security Agency (opens in a new tab)

What it says

Published on 8 October 2026 under code AA26-281A; it is signed by the FBI, CISA, NSA, NCSC-UK, ASD's ACSC, Canada's Cyber Centre, Japan's NPA and NCO, NCSC-NZ and Spain's National Intelligence Centre (CNI).
It attributes to Integrity Technology Group, a Chinese company with ties to the Government, the enabling of activity whose techniques match those of Flax Typhoon, Ethereal Panda and Red Juliett.
Techniques described: the MicroScan tool with more than 1,300 pentesting scripts, XSS to steal credentials, password spraying with EBurst against Exchange and Microsoft 365, persistence with the SoftEther VPN and DCSync against Active Directory.
It lists eight successfully exploited CVEs, from CVE-2014-6278 (Bash) to CVE-2023-22894 (Strapi); five of them have now been added to CISA's KEV catalogue.
It recommends disabling unused services and ports, sanitising inputs in web applications, requiring MFA on all services and patching in time; it publishes the indicators in STIX JSON and XML.

The Tech Guardian summarises and comments in its own words on third-party publications. The full information is in the original source, which we recommend you read.

Our take

If your organisation keeps Exchange exposed or email without MFA, this advisory affects you even if you are not critical infrastructure: the group lives off old flaws and weak passwords, not exotic exploits. Review the CVEs from 2014 to 2023 that it lists, load the STIX indicators into your EDR and watch for SoftEther installations disguised as conhost.exe or dllhost.exe. The fact that the CNI signs the advisory gives it direct relevance in Spain.

# Cloud and infrastructure Cybersecurity incidents Vulnerabilities

NVIDIA and Microsoft bring RTX Spark laptops to Windows, with up to 128 GB of unified memory

The first laptops with RTX Spark, which pairs a Blackwell GPU with a Grace CPU, can be reserved from October 7 and arrive on the 16th. NVIDIA also previews a DGX Station for Windows.