Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven Domains

CISA, the FBI and the NSA joined agencies in six other countries on Oct. 8 to publish advisory AA26-281A, which ties scanning, phishing and mailbox-theft tools to Integrity Technology Group, a China-based company with links to the Chinese government.

The advisory describes tooling and tradecraft, not a new vulnerability. Nothing in it needs a patch that was released this week, and that is the useful part for defenders.

What the advisory attributes to Integrity Technology Group

The co-signers are CISA, the FBI, the NSA, the UK's NCSC, Australia's ASD and ACSC, the Canadian Centre for Cyber Security, Japan's NPA and NCO, New Zealand's NCSC-NZ and Spain's CNI, according to the advisory. It says the company acquires or builds cyber tools, hosts infrastructure and compromises networks, using botnets, VPN infrastructure, living-off-the-land techniques and open repositories of exploit code.

The attribution is hedged. The advisory says the activity is consistent with Flax Typhoon, Ethereal Panda and Red Juliett, but may not map one to one onto the groups vendors track, and that the actors may also do work unrelated to Integrity Tech. It also says the techniques "are not unique to Chinese threat actors."

Victims named by the advisory include US government, manufacturing, healthcare and IT organisations, plus law enforcement, schools and religious bodies. Email theft in Southeast Asia hit government, law enforcement, healthcare and religious institutions.

The CVEs the actors reach for

Appendix B lists eight vulnerabilities. The newest is from 2023. Five carry an asterisk meaning they were newly added to CISA's Known Exploited Vulnerabilities catalog with this advisory.

CVE	Product	Newly in KEV
CVE-2014-6278	GNU Bash through 4.3	No
CVE-2015-3306	ProFTPD 1.3.5	Yes
CVE-2015-5477	ISC BIND 9.x	Yes
CVE-2016-3081	Apache Struts 2.3.x	Yes
CVE-2019-11510	Pulse Connect Secure	No
CVE-2021-22205	GitLab from 11.9	No
CVE-2021-3199	ONLYOFFICE DocumentServer 5.1.5 to 5.6.2	Yes
CVE-2023-22894	Strapi up to 4.5.5	Yes

The tools are mostly commodity. Reconnaissance runs on Fscan, masscan, Nmap, dirsearch and wpscan, plus MicroScan, a Python web application in use since 2017 with more than 1,300 penetration-testing scripts. For mailbox theft the advisory describes EBurst, an open-source password sprayer for Microsoft 365 and Exchange, and a PHP bot that pulls mail through the Exchange Web Services API and uploads it to a staging domain. DC.exe performs DCSync against domain controllers.

Persistence relies on SoftEther VPN clients, often renamed conhost.exe or dllhost.exe, which hide command traffic inside software endpoint tools tend to trust. The actors also ran a custom web application that gave third parties access to stolen email, and restricted some stolen data to IP addresses in Xiamen, China.

Seven domains seized

The Justice Department and the FBI seized seven domains that supported MicroScan and a spear-phishing tool called FishHub, Help Net Security reported on Oct. 9. Brett Leatherman, Assistant Director of the FBI Cyber Division, said: "By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure."

Help Net Security counts about 20 Taiwanese universities as confirmed FishHub victims. iTnews reports that this is the second US disruption of the company: a court-authorised operation in September 2024 took down a Mirai botnet of more than 200,000 consumer devices, and Treasury sanctioned the firm in January 2025. The Help Net Security domain list does not reconcile with its own count of seven, so the DOJ seizure notice is the document to check.

An ASD spokesperson told iTnews the vulnerabilities and techniques are "applicable to Australian entities." Australia was not named as a victim location.

What a defender does with a list of old CVEs

The exposure here is unpatched, aged internet-facing software, and the advisory's mitigations follow from that: disable unused services, require MFA on webmail and VPNs, monitor for unexpected Active Directory replication, and replace end-of-life products. The Palo Alto GlobalProtect flaw ransomware crews are using shows the same pattern, an old patch gap exploited long after a fix existed, and the Google DevSite cookie flaw shows how a single leaked secret can undo a hardened stack.

Check the indicator tables before blocking anything. The advisory warns that some indicators date to 2016, and it recommends vetting them first. The five CVEs newly added to the KEV catalog carry the federal patch clock, and any organisation running ProFTPD 1.3.5, Struts 2.3.x or ONLYOFFICE DocumentServer 5.1.5 to 5.6.2 should start there.