China-Linked Scanner Holds 1,300 Exploit Scripts, FBI Says
Nine agencies across eight countries published indicators for Integrity Technology Group on 8 October. Four of the eight vulnerabilities they list were disclosed between 2014 and 2016.
The FBI has recovered a Python web application holding more than 1,300 penetration-testing scripts from its investigations into Integrity Technology Group, a China-based company that nine agencies in eight countries say equips Chinese government-linked hackers. The tool is called MicroScan, and a joint advisory published on 8 October 2026 says these actors have used it since 2017.
Advisory AA26-281A carries the names of the FBI, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the cyber agencies of the United Kingdom, Australia, Canada and New Zealand. Two more sit beside the Five Eyes: Japan's National Police Agency and National Cybersecurity Office, and Spain's Centro Nacional de Inteligencia. The analysis comes from technical evidence recovered during multiple FBI investigations.
Eight flaws, and when their patches shipped
The advisory lists eight vulnerabilities. Four were disclosed between 2014 and 2016: CVE-2014-6278 in GNU Bash, CVE-2015-3306 in ProFTPD, CVE-2015-5477 in ISC BIND and CVE-2016-3081 in Apache Struts. The rest are CVE-2019-11510 in Ivanti Pulse Connect Secure, CVE-2021-3199 in ONLYOFFICE Docs, CVE-2021-22205 in GitLab and CVE-2023-22894 in Strapi. The newest is three years old.
CISA added five of them to its Known Exploited Vulnerabilities catalogue the same day, each with a remediation deadline of 11 October. The catalogue file published that evening, version 2026.10.08, holds 1,739 entries. The other three were already listed, the GitLab and Pulse Connect Secure flaws since November 2021. The deadline ran out on Sunday. Three days is the window CISA set for the Cisco Catalyst SD-WAN Manager bypass in September, as Parallax Nexus reported on 1 October, but Cisco's was a fresh CVSS 9.8 flaw, not one patched twelve years ago.
What the toolkit does once it is inside
MicroScan's scripts target services including OpenSSL, Oracle WebLogic, WordPress, Juniper ScreenOS, Jenkins and Apache Struts, according to the advisory. Alongside it the actors run off-the-shelf scanners including Fscan, masscan, NMAP, dirsearch and wpscan. The authoring organisations read that choice as a signal about target selection. "The use of open source tools typically found on GitHub suggests the threat actors tend to look for more vulnerable targets," the advisory states.
The FBI also recovered a cross-site scripting payload. Executed on a vulnerable site, it rewrites the page to show username and password fields, then hands the visitor a password-protected .zip file built from bytes encoded inside the payload itself. Inside is live700_v1.exe, which starts a process named DiagTrack.exe, borrowing the name of legitimate Windows software, and opens encrypted communications over HTTP with dns.studiocloud.xyz, a domain the FBI attributes to Integrity Tech. It carries functions for querying user mailboxes, so the FBI assesses it likely targets email for exfiltration.
For credentials the actors use EBurst, an open-source Python tool that sprays passwords against Microsoft Exchange and Office 365 across ten interfaces, from Outlook Web Access to ActiveSync. Persistence comes from SoftEther, a legitimate VPN client, fetched with PowerShell or curl, renamed conhost.exe or dllhost.exe and set to reconnect at startup. Endpoint detection software, the advisory notes, is less likely to flag software that is not malicious.
Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them.
A low bar, cleared repeatedly
The honest reading is that nothing here describes a hard target. The named sectors are government services and facilities, critical manufacturing, healthcare and public health, and information technology, plus US law enforcement, education and religious organisations, and victims across Southeast Asia, Africa and North America. What changed on 8 October was not the severity of these flaws, whose scores are unaltered, but official confirmation that someone is using them. A twelve-year-old Bash bug does not grow more dangerous with age. It grows more embarrassing.
Several things are not known. The advisory gives no count of compromised organisations, no period beyond initial access "since at least mid-January 2021", and no word on whether the five new entries were used against federal networks. CISA also qualifies its own attribution, noting that commercial trackers call this activity Flax Typhoon, Ethereal Panda and Red Juliett and that those labels "may not be a 1:1 correlation" to the US government's understanding. Integrity Tech, sanctioned by the US Treasury in January 2025, has not commented.
What happens next?
- Federal civilian agencies that missed the 11 October deadline must either patch the five newly listed flaws or stop using the affected products under Binding Operational Directive 22-01.
- CISA has published indicators of compromise as STIX JSON and XML, giving defenders outside government the domains and file hashes to hunt against.
- Watch whether Treasury or the State Department follows the advisory with further designations, as happened after the September 2024 botnet advisory.
- Integrity Tech has not responded publicly, and any statement from Beijing would be the first on this specific advisory.
Related topics
Sources & references
- 01Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (AA26-281A) — CISAprimaryJoint advisory published 8 October 2026; source of the MicroScan, EBurst and SoftEther detail and the eight CVEs.
- 02CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors — CISAprimaryNews release accompanying the advisory; source of the Leatherman quote.
- 03Known Exploited Vulnerabilities Catalog, version 2026.10.08 — CISAdataCatalogue feed released 8 October 2026 at 20:09 UTC; 1,739 entries. Confirms the five additions and their 11 October due dates.
- 04Treasury Sanctions Technology Company for Support to Malicious Cyber Group — US Department of the TreasuryprimaryJanuary 2025 OFAC designation of Integrity Technology Group.
- 05Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies — The Hacker NewsnewsTrade coverage of the KEV additions, 9 October 2026.
More from Security
Stolen GitHub Tokens Put Malware in a LiteLLM Release
A compromised release pipeline put a poisoned LiteLLM build on PyPI and Docker for under three hours on 21 October 2026. It harvested cloud secrets, AI provider API keys and SSH keys, and Wiz says the attackers were spending stolen AWS credentials about four and a half hours later.
Mirai Operators Join PHP2Shell Attacks, No Breach Confirmed
The two critical PHP engine flaws known as PHP2Shell have drawn botnet traffic, a working ASLR bypass and an attacker toolkit left publicly browsable, yet no vendor has reported a successful in-the-wild compromise as of 23 October 2026.
Attackers Are Escalating to Root Through a Japanese Web Firewall
A command injection flaw in the SiteGuard Server Edition web application firewall, CVE-2026-106931, is being exploited to run commands as root or SYSTEM. JPCERT/CC alerted users on 14 October 2026 and the vendor told support customers on 29 September.
China-Linked Actor Had Root on BeyondTrust Since August
A critical flaw in BeyondTrust Remote Support appliances, CVE-2026-102764, was exploited as a zero-day in late August 2026 by a suspected PRC-nexus espionage actor that Google tracks as ARMORY CASTLE. BeyondTrust patched its SaaS tenants on 9 October and disclosed the vulnerability on 15 October. Self-hosted customers have to apply the patch themselves.