Chinese Government-Linked Cyber Actors Use Automation and Manual Hacking to Steal Data

Chinese-Linked Cyber Actors Blend Automation With Hands-On Hacking

A new joint cybersecurity advisory from the Australian Cyber Security Centre and international security agencies details how Chinese government-linked cyber threat actors are combining automated tools, large-scale infrastructure and hands-on intrusion techniques to gain access to networks and steal sensitive information.

The advisory was published on 9 October 2026 and is based on technical evidence recovered and observed during multiple FBI investigations involving Integrity Technology Group, a China-based company with links to the Chinese government.

The advisory was jointly released by the FBI, CISA, NSA, the UK's NCSC, Australia's ACSC, Canada's Cyber Centre, Japan's National Police Agency and National Cybersecurity Office, New Zealand's NCSC and Spain's CNI.

The central concern is not a single vulnerability or malware family. Instead, the report describes an operational model that combines automated reconnaissance and exploitation with manual activity after access has been obtained.

For defenders, this means monitoring only one stage of an attack may not be enough.

How the Attack Activity Works

The advisory describes a combination of:

• Large-scale botnets

• VPN infrastructure

• Living-off-the-land techniques

• Open-source scanning tools

• Computer network exploitation tools

• Credential attacks

• Web application attacks

• Manual data collection

• Automated data exfiltration

The authoring organisations note that these techniques are not unique to Chinese threat actors. However, the advisory provides detailed evidence of how the actors associated with Integrity Technology Group combine them to support computer network exploitation activity.

Reconnaissance Starts With Broad Network Scanning

According to the advisory, the actors use several open-source scanning tools to identify vulnerabilities in networks and web applications.

The tools identified include BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe and wpscan. The advisory says these tools can be used for activities such as fingerprinting remote applications, testing authentication protocols and enumerating website pages.

The actors generally focused on commonly exposed services and ports, including FTP, SSH, DNS, HTTP, HTTPS and SOCKS.

The advisory also describes MicroScan, a Python-based web application containing more than 1,300 penetration-testing scripts. Investigators observed the tool being used to scan websites for vulnerabilities affecting technologies including OpenSSL, Oracle WebLogic, WordPress, Jenkins and Apache Struts.

This approach allows attackers to identify potentially vulnerable systems before attempting deeper intrusion activity.

XSS Used to Harvest Credentials

The advisory also describes the use of cross-site scripting, or XSS, as an initial access technique.

Investigators recovered an XSS payload that could modify content on a vulnerable website and display username and password fields. This could allow credentials entered by users to be harvested.

The recovered payload also generated a link to download a password-protected archive containing an executable. Investigators linked the subsequent activity to infrastructure attributed to Integrity Technology Group.

This illustrates why web application security remains an important part of network defence. A vulnerability in a web application can become an entry point into broader credential and data theft activity.

Password Spraying Targets Microsoft Exchange

The actors also used EBurst, an open-source Python tool, against Microsoft Office 365 and Microsoft Exchange environments.

The advisory says EBurst can attempt password spraying and password guessing against multiple Microsoft Exchange interfaces. These include Exchange Control Panel, Exchange Web Services, Offline Address Book, Outlook Web Access, RPC, API, MAPI, PowerShell, Autodiscover and Microsoft-Server-ActiveSync.

This is significant for defenders because protecting only one Exchange interface may leave other interfaces exposed.

The advisory specifically recommends that defenders consider these interfaces when defending against EBurst activity.

VPN Software Used to Maintain Persistence

Once access is obtained, the actors can use VPN software to maintain access and make command-and-control activity harder to attribute.

The advisory describes the use of SoftEther VPN clients installed on compromised systems. The software can be configured to reconnect automatically when a device starts.

Investigators also observed installers being renamed to resemble legitimate Windows executables, including names such as conhost.exe and dllhost.exe. The advisory notes that because SoftEther is legitimate VPN software, its presence may be less likely to immediately trigger endpoint detection.

This is an example of a broader defensive challenge: legitimate software can be abused as part of malicious activity.

Email Data Becomes a Major Collection Target

After establishing access, the actors can collect information from compromised environments.

The FBI observed activity involving databases and victim email accounts. The advisory describes both manual collection and automated scripts used to gather email data.

One example is Curlc4.txt, a PHP script designed to interact with the Microsoft Exchange Web Services API. The script could access email and related content such as calendars and contacts before uploading the collected information to a remote server.

The advisory also describes the use of compression and, in some cases, encryption before data was exfiltrated.

Another tool, DC.exe, was observed using the DCSync replication technique to obtain sensitive Active Directory information, including account credentials, group membership information and trust relationships.

The Threat Activity Extends Beyond Email

The advisory documents several other tools and techniques used during different stages of the intrusion.

These include:

• Network and web application scanning

• Password spraying

• Credential harvesting

• XSS attacks

• VPN-based persistence

• Active Directory credential collection

• Remote email collection

• Local data staging

• Automated exfiltration

• Use of legitimate utilities to reduce visibility

The activity was mapped by the authoring organisations to the MITRE ATT&CK Enterprise framework, providing defenders with a structured way to compare observed behaviours with their own security controls.

Who Was Targeted?

The advisory says the threat actors targeted organisations across several US critical infrastructure sectors, including:

• Government services and facilities

• Critical manufacturing

• Healthcare and public health

• Information technology

The activity also affected or targeted organisations in areas including US law enforcement, education and religious organisations.

Beyond the United States, the advisory identifies activity involving organisations across Southeast Asia, Africa and North America.

The advisory also notes that the actors enabled by Integrity Technology Group have used tactics, techniques and procedures consistent with activity publicly associated with Flax Typhoon, Ethereal Panda and Red Juliett, while cautioning that cybersecurity organisations may use different methodologies when tracking and attributing these activity clusters.

What Organisations Should Watch For

The advisory provides several practical indicators that security teams can monitor.

These include:

• Unusual account activity

• Network scanning

• Unexpected access to sensitive data

• Suspicious web application activity

• Unusual outbound traffic

• Unexpected VPN software

• Suspicious command-line activity

• Unusual IP addresses and ports

• Changes to firewall configurations

• Logins outside normal working hours

• Impossible-travel login patterns

• Attempts to access cloud applications connected to sensitive information

Organisations are also encouraged to review the indicators of compromise provided in the advisory and investigate them before taking blocking actions, because some indicators date back to 2016.

Recommended Defensive Measures

The joint advisory recommends a layered approach to reducing risk.

1. Reduce Internet Exposure

Organisations should disable unused services and ports and reduce unnecessary information exposed by externally accessible systems.

The advisory also recommends considering attack surface management services or web-based tools that identify exposed services and ports.

2. Strengthen Authentication

The advisory recommends implementing identity, credential and access management policies and using multi-factor authentication, particularly for webmail, VPNs and accounts that access critical systems.

Organisations should also replace default passwords, limit administrative privileges and regularly review privileged access.

3. Secure Web Applications

Input sanitisation is recommended to reduce the possibility of XSS payload injection.

Security teams should also review web application access logs for signs of exploitation attempts, including directory traversal, command injection and enumeration activity.

4. Patch Systems

The advisory recommends applying software and firmware updates and using trusted automatic update mechanisms where available.

5. Monitor Network Traffic

Security teams should monitor for abnormal or high-volume scanning activity and unexpected outbound traffic.

The advisory specifically recommends watching for high volumes of uploads from systems that normally have relatively low outbound traffic.

6. Monitor Accounts and Cloud Access

Organisations should watch for unusual account activity and investigate access patterns that do not match normal behaviour.

The advisory also recommends monitoring cloud accounts for connected applications that can access sensitive file and email data.

7. Maintain Secure Backups

The guidance recommends maintaining multiple copies of sensitive or proprietary data in separate, segmented and secure locations.

Critical backups should not be directly accessible for modification or deletion from the systems where the original data resides.

Incident Response Should Begin With Scoping

If an organisation suspects compromise, the advisory recommends first determining which systems were affected and isolating compromised hosts.

Security teams should then conduct threat hunting and review relevant logs, artifacts and other data to establish the scope of the intrusion, affected devices and accounts, and the timeline of activity.

The guidance also recommends following applicable national cyber incident reporting requirements and applying countermeasures to contain and remove the threat actor.

This approach is important because removing a visible malicious file does not necessarily establish that an intrusion has been fully contained.

Security Controls Should Be Tested, Not Just Deployed

One of the advisory's broader recommendations is to validate existing security controls against the behaviours described in the report.

The authoring organisations recommend selecting an ATT&CK technique, identifying the security technologies intended to detect or prevent it, testing those technologies, analysing their performance and then tuning the security programme based on the results.

What This Advisory Means for Defenders

The advisory highlights a broader industry shift toward multi-stage cyber operations that combine scale with targeted human activity.

Automated scanning can help attackers identify potential entry points across large numbers of systems. After gaining access, operators can use legitimate software, credentials, VPN infrastructure and manual collection techniques to move deeper into an environment.

For enterprises, this could mean that defensive monitoring needs to cover the entire attack lifecycle rather than focusing only on malware detection.

The advisory's recommendations point toward several practical priorities: reduce exposed services, strengthen authentication, patch vulnerable systems, monitor cloud and network activity, hunt for indicators of compromise and regularly validate security controls.

The development also reflects growing demand for security teams to combine attack surface management, identity security, endpoint monitoring, network visibility and incident response rather than treating these areas as isolated controls.

Conclusion

The joint advisory provides a detailed look at how China-linked threat actors associated with Integrity Technology Group combine automated reconnaissance and exploitation tools with hands-on intrusion activity.

The documented techniques range from open-source scanning and password spraying to XSS-based credential harvesting, VPN persistence, Active Directory data collection and automated email exfiltration.

For defenders, the key lesson is the importance of visibility across the complete attack chain.

Organisations should not only look for known malware. They should also monitor unusual authentication, exposed services, suspicious legitimate software, unexpected network activity, abnormal cloud access and signs of data collection.

The advisory provides IOCs, technical details and mitigation guidance that security teams can use to hunt for potential compromise and strengthen existing controls.

Source: Australian Cyber Security Centre (ACSC), joint advisory published 9 October 2026. The advisory was authored jointly with the FBI, CISA, NSA and international cybersecurity agencies.