Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data

What is affected, what to do

Listen warning Advisory Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data Learn how Chinese state-linked cyber actors steal sensitive data and discover practical steps to detect, prevent and respond to attacks. Published 09 Oct 2026 Last reviewed 09 Oct 2026 | <button class="page-header__print-link" type="button" aria-expanded="false" aria-controls="page-header-print-menu" data-header-menu-trigger > print Print page Print page <button class="page-header__share-link" type="button" aria-expanded="false" aria-controls="page-header-share-menu" data-header-menu-trigger > email Email or share link chevron_right <a href="https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="x" aria-label="Share on X" > <a href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data"e=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="facebook" aria-label="Share on Facebook" > <a href="https://www.linkedin.com/feed/?shareActive=true&text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="linkedin" aria-label="Share on LinkedIn" > <a href="mailto:?subject=Chinese%20government-linked%20cyber%20threat%20actors%20combine%20automated%20and%20hands-on%20hacking%20tools%20to%20steal%20sensitive%20data&body=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" data-share-network="email" data-share-subject="Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data" aria-label="Share by email" > <button class="page-header__print-share-link" type="button" aria-expanded="false" aria-controls="page-header-mobile-menu" data-header-menu-trigger > Print or share chevron_right Print page <img data-component-id="cybergovau:image" class="cga-image page-header__image cga-image--lazy cga-image--banner cga-image--responsive" loading="lazy" data-image-style="banner" src="/themes/custom/cybergovau/assets/images/page-header.svg" alt="" > eye_tracking At a glance Calculating...

The available sources name no fixed version. Check the vendor guidance in the references below.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Listen warning Advisory Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data Learn how Chinese state-linked cyber actors steal sensitive data and discover practical steps to detect, prevent and respond to attacks. Published 09 Oct 2026 Last reviewed 09 Oct 2026 | <button class="page-header__print-link" type="button" aria-expanded="false" aria-controls="page-header-print-menu" data-header-menu-trigger > print Print page Print page <button class="page-header__share-link" type="button" aria-expanded="false" aria-controls="page-header-share-menu" data-header-menu-trigger > email Email or share link chevron_right <a href="https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="x" aria-label="Share on X" > <a href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data"e=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="facebook" aria-label="Share on Facebook" > <a href="https://www.linkedin.com/feed/?shareActive=true&text=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" target="_blank" rel="noopener noreferrer" data-share-network="linkedin" aria-label="Share on LinkedIn" > <a href="mailto:?subject=Chinese%20government-linked%20cyber%20threat%20actors%20combine%20automated%20and%20hands-on%20hacking%20tools%20to%20steal%20sensitive%20data&body=https%3A%2F%2Fwww.cyber.gov.au%2Fadvisory%2Fchinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data" class="page-header__icon-link" role="menuitem" data-share-network="email" data-share-subject="Chinese government-linked cyber threat actors combine automated and hands-on hacking tools to steal sensitive data" aria-label="Share by email" > <button class="page-header__print-share-link" type="button" aria-expanded="false" aria-controls="page-header-mobile-menu" data-header-menu-trigger > Print or share chevron_right Print page <img data-component-id="cybergovau:image" class="cga-image page-header__image cga-image--lazy cga-image--banner cga-image--responsive" loading="lazy" data-image-style="banner" src="/themes/custom/cybergovau/assets/images/page-header.svg" alt="" > eye_tracking At a glance Calculating... This joint cyber security advisory explains how Chinese government-linked cyber actors use a range of tools and techniques to gain access to networks and steal sensitive data. It describes how these actors operate, the signs that an organisation may be compromised, and the methods they use to avoid detection. The advisory also provides practical advice to help organisations identify, respond to and reduce the risk of this activity. It is written for cyber security professionals, IT administrators and decision-makers across government, critical infrastructure, and organisations of all sizes. check_box Key actions Review your systems for signs of compromise using the indicators of compromise (IOCs) and threat activity described in the advisory. Strengthen your security controls by enabling multi-factor authentication, applying patches, and disabling unused services and ports. Monitor for suspicious activity, including unusual account use, network scanning, and attempts to access sensitive data. Update your incident response plans and prepare your organisation to detect, contain and recover from cyber incidents. Introduction Integrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit U.S. and foreign organization networks across multiple sectors using various tools and techniques. This advisory provides an analysis of tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) from Integrity Technology Group and the threat actors they enable (hereafter referred to as “the threat actors”). The analysis in this advisory provides network defenders with detection and mitigation guidance to reduce the risk of threat actors compromising critical data. The threat actors use a unique combination of large-scale botnets, virtual private network (VPN) infrastructure, living-off-the-land (LOTL) techniques, and repositories of computer network exploitation (CNE) tools. Although these techniques are not unique to Chinese threat actors, this advisory details how the threat actors use them to support CNE activity. The threat actors targeted victims across multiple U.S. critical infrastructure sectors, including: Government Services and Facilities , Critical Manufacturing , Healthcare and Public Health , and Information Technology . The actors also targeted victims in U.S. law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, and North America. The information in this advisory originates from technical evidence recovered from, and observed during, multiple Federal Bureau of Investigation (FBI) investigations related to Integrity Technology Group. The FBI, Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), United Kingdom National Cyber Security Centre (NCSC-UK), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (Cyber Centre), Japan’s National Police Agency (NPA) and National Cybersecurity Office (NCO), New Zealand’s National Cyber Security Centre (NCSC-NZ), and Spain’s Centro Nacional de Inteligencia (CNI), hereafter referred to as “the authoring organizations”—are releasing this joint cybersecurity advisory to urge network defenders from government and relevant organizations to: Hunt for potential compromises from this activity. Better protect against this threat activity and other Chinese government-linked cyber targeting. This advisory also provides our U.S. federal, state, local, territorial, and tribal (FSLTT) government agencies, and international and industry partners, with the indicators and details necessary to proactively defend their networks against this threat and protect critical data. For more information on People’s Republic of China (PRC) state-sponsored malicious cyber activity in general, see the FBI’s Cyber Threat Overview: China webpage. For more information on China-linked malicious cyber activity, see CISA’s People’s Republic of China Threat Overview and Advisories webpage. The authoring organizations encourage network defenders to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of these incidents. For a downloadable copy of IOCs, see: AA26-281A STIX XML AA26-281A STIX JSON Threat actor background Integrity Technology Group (Integrity Tech) is a China-based for-profit company with links to the Chinese government. Integrity Tech employs individuals who support malicious cyber activity in different ways, including acquiring or building cyber tools for use and sale, acquiring and hosting infrastructure, and compromising networks across global victims, which the authoring organizations track as China-based malicious cyber activity. The services provided by Integrity Tech also contribute to the larger Chinese cyber ecosystem, which aims to exfiltrate sensitive data from victims around the world. Notably, the threat actors enabled by Integrity Tech use TTPs consistent with the cyber activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett, among others. However, these threat actors may also perform activity not associated with Integrity Tech. Note : Cybersecurity companies have different methods of tracking and attributing cyber actors and these may not be a 1:1 correlation to the U.S. Government's methodology and understanding for all activity related to these groupings. Technical details Note : This advisory uses the MITRE ATT&CK® Matrix for Enterprise framework, version 19. See Appendix A: Indicators of Compromise and the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques. Reconnaissance The threat actors use a variety of open source scanning tools to find vulnerabilities in networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [ T1595.002 ]. See Appendix A: Indicators of Compromise for a complete list of scanning tools. Some of these tools contain features useful for fingerprinting remote applications, testing remote authentication protocols, or enumerating the pages of a website. The use of open source tools typically found on GitHub suggests the threat actors tend to look for more vulnerable targets. In general, the threat actors focus on scanning ports 21 (file transfer protocol [FTP]), 22 (SSH), 53 (domain name system [DNS]), 80 (HTTP), 443 (HTTPS), and 1080 (SOCKS). When scanning websites with dirsearch, the threat actors attempt to enumerate PHP and ASP ( .NET ) pages. MicroScan As early as 2017, these threat actors have also used a malicious application known as “MicroScan.” This Python-based web application contains over 1,300 penetration testing scripts written to scan websites for specific vulnerabilities. The threat actors used these scripts to target services including OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. See Appendix B: Observed Common Vulnerabilities and Exposures for a list of successfully exploited common vulnerabilities and exposures (CVEs) recovered from penetration testing scripts. Figure 1 shows a MicroScan account dashboard displaying detected vulnerabilities. Image Figure 1. MicroScan account dashboard showing detected vulnerabilities Initial access and execution Since at least mid-January 2021, the threat actors have gained access to victim networks and cloud-based services primarily through command line utilities built on exploit codes written in popular programming languages, such as Python and Go [ T1059.006 ]. Additionally, the threat actors have used JavaScript [ T1059.007 ] and HTML code to execute cross-site scripting (XSS) attacks. XSS vulnerabilities allow malicious actors to use unwitting third-party applications vulnerable to XSS to modify content on a webpage [ T1189 ] and target other victims. During the investigations, the FBI recovered an XSS payload used by the threat actors. When executed on a vulnerable website running JavaScript, this payload modifies webpage content to display username and password fields, facilitating user credential harvesting (see Figure 2). Image Figure 2. Executed XSS payload After a user enters any username and password, the executed XSS payload page generates a link to download a password-protected .zip file. The .zip file’s contents originate from encoded bytes within the XSS payload and contain the executable file live700_v1.exe . Analysis of live700_v1.exe demonstrated the executable begins a process named DiagTrack.exe , which shares its name with legitimate Windows software [ T1036.003 ]. DiagTrack.exe then establishes encrypted communications over the HTTP protocol with the domain dns.studiocloud.xyz , which the FBI attributes to Integrity Tech. Given that the executable also contains functions designed to query data from use

Source: ASD ACSC (CC BY 4.0)