Integrity Tech: the arsenal behind Flax Typhoon

On 8 October 2026, the United States cybersecurity agency CISA (1) published, together with the FBI (2), the NSA (3), the United Kingdom’s NCSC-UK (4), Australia’s ASD (5) through its ACSC (6), the Canadian Centre for Cyber Security, Japan’s NPA (7) and NCO (8), New Zealand’s NCSC-NZ (9) and Spain’s CNI (10), a joint advisory referenced AA26-281A. Ten agencies from seven countries describe in it how a Chinese company, Integrity Technology Group (Integrity Tech), enables China-linked cyber actors to steal sensitive data from organisations worldwide, including United States critical infrastructure sectors.

The document draws on technical material gathered during several FBI investigations into Integrity Tech. It describes a coherent set of TTPs (11): vulnerability research using open source scanning tools, cross-site scripting (XSS) (12) attacks, password spraying against Microsoft Exchange accounts, persistence through a hijacked VPN (13), and exfiltration of mailboxes through custom scripts. The victims identified span the Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology sectors in the United States, as well as law enforcement agencies, educational institutions and religious organisations in Southeast Asia, Africa and North America.

Integrity Tech is a for-profit Chinese company, based in Beijing and linked to the Chinese government. Its employees support malicious cyber activity in several ways: acquiring or developing tools, hosting infrastructure, and directly compromising networks at victims worldwide. The advisory refers to the whole of this activity, attributed to China, under the generic term actors; this article uses the same term to refer to the cyber actors that Integrity Tech supports.

On 3 January 2025, OFAC (16), the US Treasury office responsible for economic sanctions, had already targeted Integrity Tech for its infrastructure role in several computer intrusions publicly attributed to Flax Typhoon between summer 2022 and autumn 2023. The Treasury noted that Integrity Tech hosted infrastructure used by Flax Typhoon for its CNE (17) activity, with regular exchanges of information between the two. Integrity Tech’s US assets were blocked and any transaction with the company by a US person was prohibited.

The AA26-281A advisory states that the actors supported by Integrity Tech employ TTPs consistent with activity publicly known under the names Flax Typhoon, Ethereal Panda and Red Juliett, among others. The signing authorities note that cybersecurity companies track and attribute actors using different methods, which do not necessarily map one to one onto the US government’s methodology for this activity as a whole.

The actors rely on a wide range of open source scanning tools to identify vulnerabilities in networks and web applications: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe and wpscan. Several of these tools can fingerprint a remote application, test authentication protocols or enumerate a site’s pages. According to the authorities, the use of open source tools widely available on GitHub points to a search for the most vulnerable targets rather than bespoke targeting.

Scanning focuses on ports 21 (FTP (18)), 22 (SSH (19)), 53 (DNS (20)), 80 (HTTP (21)), 443 (HTTPS (22)) and 1080 (SOCKS (23)). When using dirsearch against a website, the actors specifically look to enumerate PHP (24) and ASP (.NET) pages.

MicroScan, a penetration testing platform since 2017

Since at least 2017, the actors have also used an application called MicroScan. This Python web application bundles more than 1,300 penetration testing scripts written to search for specific vulnerabilities on websites. The scripts target OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins and Apache Struts, among others. The CVEs successfully exploited and found in these penetration testing scripts are covered in the next section.

• Associated ATT&CK technique: Active Scanning: Vulnerability Scanning, T1595.002
• First documented use of MicroScan: as early as 2017
• Contents of MicroScan: more than 1,300 penetration testing scripts

Appendix B of the advisory lists eight CVEs successfully exploited by MicroScan’s penetration testing scripts. Five of them, marked with an asterisk by the authorities, have just been added to CISA’s KEV catalogue: checking the catalogue’s JSON feed confirms an addition dated 8 October 2026, the day the advisory was published, with a remediation deadline set at 11 October 2026. The other three had already been on the catalogue for longer: two since 3 November 2021 (Pulse Connect Secure and GitLab, both flagged with a history of ransomware exploitation) and one since 2 October 2025 (Bash).

Fig. 1. The eight CVEs successfully exploited (Appendix B of the advisory). The asterisk marks the five CVEs added to the KEV catalogue on 8 October 2026; KEV status and dates were verified against the catalogue’s JSON feed, independently of the advisory’s text.

Since at least mid-January 2021, the actors have accessed their victims’ networks and cloud services mainly through command-line utilities built on exploit code written in Python and Go. They also use JavaScript and HTML code to carry out XSS attacks, which hijack an unwitting third-party application vulnerable to XSS to modify a web page’s content and reach further victims.

The FBI recovered an XSS payload used by the actors. Executed on a vulnerable website running JavaScript, it modifies the page’s content to display username and password fields, with the aim of harvesting the credentials the victim enters. Once any username and password are entered, the page generated by the XSS payload offers a download link to a password-protected .zip archive. The contents of that archive come from bytes encoded directly in the XSS payload and contain the executable live700_v1.exe.

Analysis of live700_v1.exe shows that it starts a process named DiagTrack.exe, which reuses the name of a legitimate Windows utility. DiagTrack.exe then establishes encrypted HTTP communications with the domain dns.studiocloud[.]xyz, which the FBI attributes to Integrity Tech. As the executable contains functions that query mailbox data, the FBI assesses that this malware probably aims at mailbox data exfiltration.

The actors use EBurst, an open source Python tool, to target accounts in the Microsoft Office 365 Cloud environment. The tool compromises mailbox accounts on Microsoft Exchange servers by combining several interfaces to carry out password spraying and password guessing against each supplied email address. According to the ReadMe file of the open source EBurst project, these interfaces include:

• ECP (27), the Exchange control panel
• EWS (28), Exchange Web Services
• OAB (29), the offline address book
• OWA (30), Outlook Web Access
• RPC (31), remote procedure call
• API (32)
• MAPI (33), the messaging application programming interface
• PowerShell
• Autodiscover
• Microsoft-Server-ActiveSync

Network defenders are encouraged to cover all of these interfaces, not just OWA or EWS, in their monitoring and detection rules against EBurst.

To establish lasting persistence, the actors deploy VPN clients on victims’ equipment to conceal command-and-control (C2 (34)) communications and the rest of their actions, which complicates attribution of the malicious network activity. For this they use SoftEther, a legitimate, open source VPN product.

On Windows, the actors download the SoftEther installers from infrastructure they control, using PowerShell or LOTL (35) binaries. On Linux and Unix, they download them using curl or wget. In both cases, the SoftEther client is configured to reconnect automatically on startup. The actors frequently name these installers conhost.exe or dllhost.exe, so that they resemble common Windows executables. Because SoftEther is a legitimate VPN product, endpoint detection tools flag it less readily than a dedicated tool.

In several observed cases, the actors installed the SoftEther program directly on the server. Analysis of these servers revealed victim domains and subdomains hosting the SoftEther connections: 98aiblog[.]com, hmbcloud[.]com, hmbcloud[.]net, hmbiplc-01[.]com, iepl.node[.]cm, javacheck.ooguy[.]com, javaupdate.giize[.]com, sexytube0[.]com and twimg.co[.]uk.

The FBI has observed the actors installing the client on the end-user workstation, which then connects to the command-and-control server through one of these domains, subdomains, or directly through the server’s IP (36) address. From these same waypoints, the actors have also accessed other targets, including the websites of cybersecurity companies.

The FBI has observed the actors downloading databases or manually extracting data from victims’ mailboxes, then staging it for exfiltration under inconspicuous file names intended to minimise detection of a MySQL mailbox export: 001.gif, All_scanner_vXX.pl.gz (where XX represents a one- or two-digit number), css.js, include.png, m2k.js, m2k_list.js and m2k_ui_adm.js.

Curlc4.txt, a PHP bot for the EWS API

The FBI has observed the actors building a bot using the PHP script Curlc4.txt to obtain victims’ messages. The script is designed to interface with Microsoft’s EWS API, which provides access to messages and other content such as calendars and contacts. The script appears to run standalone rather than being permanently installed on a compromised system; it uploads messages to a remote server, hides some of the directories and files it creates, and renames its child process crypto.

The script downloads the original file from https://upl.natcloudservice[.]com at IP address 149.28.132[.]137. The bot’s main C2 domain is natcloudservice[.]com, which communicates with https://natcloudservice[.]com/ews and upl.natcloudservice[.]com/ews. Before exfiltration, the bot compresses the messages; in some cases, the actors also encrypt the messages with a password, using RC4 (37) or AES (38)-128-CBC.

The PHP script accepts up to two command-line arguments. The first appears to designate the root directory for script execution; if it is not supplied, the script searches for a writable directory following the order in Table 1, and stores the second argument there in a variable saved on the targeted system.

Fig. 2. Directories searched by Curlc4 looking for a writable location (Table 1 of the advisory).

Unique strings found in the script: $dir/storage/fm/.run ; $dir/.run ; public $password='jh4jnryw76ikmh' ; public $file='/var/tmp/.sess.zip' ; https://upl.natcloudservice[.]com/ews ; public $key='rhnr5m54pk65wertc' ; the RC4 setting ($this->enc="r";$this->cipher="rc4";$this->iv="") ; the AES-128-CBC setting ($this->enc="a";$this->cipher="aes-128-cbc";$this->iv="1111111111111111") ; https://natcloudservice[.]com/ews ; and the custom HTTP header curl_setopt($this->ch, CURLOPT_HTTPHEADER,array("X-Id: $clientid")). Other directories and files indicate that the script has run on a system: RUNNING_DIRECTORY/storage/fm, RUNNING_DIRECTORY/storage/fm.run (file), RUNNING_DIRECTORY/.run, RUNNING_DIRECTORY/clientid (file) and RUNNING_DIRECTORY/cp (file).

DC.exe and DCSync replication

The actors use DC.exe to carry out the DCSync replication technique, which copies sensitive Active Directory (AD (39)) information: account credentials, group membership details and trust relationships. DC.exe establishes an RPC connection to the victim’s domain controller, then uses the directory replication service to extract data from it. It notably retrieves a handle to the local security policy object, used to query the domain controller for the DNS domain name, the domain SID (40) and the domain’s replication epoch. The file also relies on nineteen object identifiers (LDAP OIDs) to retrieve Active Directory attributes and configurations, including 1.2.840.113556.1.2.48, 1.2.840.113556.1.4.1 and 1.2.840.113556.1.4.609; the full list of the nineteen OIDs appears in the original advisory.

Exfiltrated data and access restriction

The FBI recovered an archived mailbox database that the actors used to target victim organisations’ mailbox accounts. The actors collect account credentials and exfiltrate mailbox data from both on-premises systems and cloud services. Victims identified for mailbox data theft include government organisations, law enforcement services, healthcare systems and religious institutions in Southeast Asia. In some cases, the actors restricted access to the exfiltrated data to IP addresses located in Xiamen, China, only.

Office-cli, automating Microsoft 365 exfiltration

The actors use the office-cli command-line utility to target and maintain ongoing access to Microsoft Outlook 365 mailbox accounts, exfiltrating their content over various periods. They occasionally refresh these accounts and replace them with more recent ones. office-cli automates access to and exfiltration of mailbox content from configuration files such as client_id, tenant_id and secret.

The FBI has observed the actors running office-cli from the command line or from a Bash script. In both cases, they place the JSON (41) files needed to access the mailboxes in the configuration directory; office-cli then saves the collected data to a subdirectory of the dump directory. The actors evade detection using this tool because it relies on legitimate access methods. They also operate a custom web application that gives third parties access to the stolen mailbox content, in which a user can pass specific arguments in a URL (42) to view the content of a given account.

The advisory itself gives its own mapping to the ATT&CK (43) framework, stating that it uses version 19 of the framework. Each technique identifier has been verified here against the official STIX (44) data of ATT&CK Enterprise, version 19.2: all the identifiers cited are valid and match the label given by the authorities.

Fig. 3. ATT&CK Enterprise v19.2 mapping, taken from the AA26-281A advisory and verified against the official STIX data.

If a compromise is detected

The authorities recommend identifying compromised hosts and isolating them, launching a threat hunt to scope the intrusion, collecting the relevant artefacts and logs to establish the timeline and the TTPs used, following national incident reporting obligations, and then applying eviction countermeasures. CISA provides a dedicated tool, the Eviction Strategies Tool, which combines the Playbook-NG web application with the COUN7ER post-compromise countermeasure database, to build a systematic eviction plan together with the expected outcome, preparatory steps and risks of each action.

Recommended mitigations

Fig. 4. Summary of the mitigations recommended by the authorities, aligned with CISA and NIST’s (48) CPGs (47).

The authorities also recommend continuously testing existing security controls against each of the ATT&CK techniques listed in section 9, using CISA Decider or an equivalent mapping tool, to objectively measure the actual performance of detections in place rather than assuming their coverage.

The advisory publishes sixteen tables of indicators and mappings, with an explicit warning from the authorities: several indicators date back as far as 2016, and verification is recommended before any blocking action. The tables below reproduce in full the named indicators and the hash sets (webshells, binaries, dropped files), directly usable for detection. The two tables of raw domain names and IP addresses are very large (218 domain names and 516 IP addresses, with first-observed dates ranging from 2012 to 2024) and are not reproduced line by line here; they are available in full, in STIX format, directly from the original advisory (see Sources).

Domains and hosts directly attributed to the activity

Unlike the two raw tables, this table qualifies each entry by its role (infrastructure or SoftEther host) and overlaps with the domains already cited in section 7.

Fig. 5. The 24 domains and hosts directly attributed to the activity (Table 12 of the advisory).

Webshells

Fig. 6. Six webshells from the actors’ CNE tooling repository (Table 13 of the advisory).

Tooling binaries and scripts

Fig. 7. Sixteen binaries and scripts from the CNE tooling repository (Table 14 of the advisory). Note that masscan and NMAP, cited in section 3, do not appear in this hash table: only their presence in the advisory’s text links them to the actors.

Files dropped on victims

Fig. 8. Ten files potentially dropped on victims (Table 15 of the advisory). Two distinct copies of dllhost.exe appear with different hashes.

The advisory is a joint primary source, co-signed by ten government bodies. The elements that can be verified independently have been cross-checked.

1. CISA (1): Cybersecurity and Infrastructure Security Agency, the United States cybersecurity and infrastructure security agency.
2. FBI (2): Federal Bureau of Investigation, the United States federal police agency.
3. NSA (3): National Security Agency, the United States signals intelligence agency.
4. NCSC-UK (4): National Cyber Security Centre, the United Kingdom’s national cybersecurity centre.
5. ASD (5): Australian Signals Directorate, Australia’s signals intelligence agency.
6. ACSC (6): Australian Cyber Security Centre, the ASD’s cybersecurity centre.
7. NPA (7): National Police Agency, Japan’s national police agency.
8. NCO (8): National Cybersecurity Office, Japan’s national cybersecurity office.
9. NCSC-NZ (9): National Cyber Security Centre, New Zealand’s national cybersecurity centre.
10. CNI (10): Centro Nacional de Inteligencia, Spain’s national intelligence centre.
11. TTP (11): Tactics, Techniques, and Procedures, the tactics, techniques and procedures used by an actor.
12. XSS (12): Cross-Site Scripting, the injection of script executed client-side in a vulnerable web page.
13. VPN (13): Virtual Private Network.
14. CVE (14): Common Vulnerabilities and Exposures, the public identifier assigned to a vulnerability.
15. KEV (15): Known Exploited Vulnerabilities, CISA’s catalogue of vulnerabilities whose exploitation has been observed.
16. OFAC (16): Office of Foreign Assets Control, the US Treasury office responsible for economic sanctions.
17. CNE (17): Computer Network Exploitation, the exploitation of a computer network for intelligence or intrusion purposes.
18. FTP (18): File Transfer Protocol.
19. SSH (19): Secure Shell, an encrypted remote access protocol.
20. DNS (20): Domain Name System.
21. HTTP (21): Hypertext Transfer Protocol, the web’s transfer protocol.
22. HTTPS (22): HTTP Secure, HTTP encrypted using TLS.
23. SOCKS (23): a protocol that relays network connections through a proxy server.
24. PHP (24): a server-side scripting language widely used in web development.
25. CWE (25): Common Weakness Enumeration, a classification of software weaknesses.
26. CVSS (26): Common Vulnerability Scoring System, the system used to rate the severity of vulnerabilities.
27. ECP (27): Exchange Control Panel, Microsoft Exchange’s control panel.
28. EWS (28): Exchange Web Services.
29. OAB (29): Offline Address Book, Exchange’s offline address book.
30. OWA (30): Outlook Web Access, Outlook’s web interface.
31. RPC (31): Remote Procedure Call.
32. API (32): Application Programming Interface.
33. MAPI (33): Messaging Application Programming Interface, Microsoft’s messaging programming interface.
34. C2 (34): Command and Control, an actor’s command-and-control infrastructure.
35. LOTL (35): Living Off the Land, the use of tools and binaries already present and legitimate on a system to carry out malicious actions.
36. IP (36): Internet Protocol, the Internet’s addressing protocol.
37. RC4 (37): Rivest Cipher 4, a stream cipher algorithm.
38. AES (38): Advanced Encryption Standard, a block cipher algorithm.
39. AD (39): Active Directory, Microsoft’s directory service.
40. SID (40): Security Identifier, the unique security identifier of a Windows account or domain.
41. JSON (41): JavaScript Object Notation, a text format for structured data.
42. URL (42): Uniform Resource Locator, the address of a resource on the web.
43. ATT&CK (43): Adversarial Tactics, Techniques, and Common Knowledge, the framework of attack tactics and techniques maintained by MITRE.
44. STIX (44): Structured Threat Information Expression, a format for exchanging threat data, used to publish ATT&CK and this advisory’s indicators.
45. ICAM (45): Identity, Credential, and Access Management.
46. MFA (46): Multifactor Authentication.
47. CPG (47): Cross-Sector Cybersecurity Performance Goal, a cross-sector cybersecurity performance goal defined by CISA and NIST.
48. NIST (48): National Institute of Standards and Technology, the United States technical standards institute.
49. MD5 (49): Message Digest 5, a hash function used here as a supplementary hash.
50. SHA-256 (50): Secure Hash Algorithm 256-bit, the hash function used for file hashes.

1. CISA, FBI, NSA, NCSC-UK, ASD’s ACSC, Canadian Centre for Cyber Security, NPA, NCO, NCSC-NZ, CNI, Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data, advisory AA26-281A, 8 October 2026. cisa.gov/aa26-281a
2. CISA, indicator-of-compromise packages for advisory AA26-281A, STIX JSON (1,021.16 KB) and STIX XML (658.87 KB) formats, 8 October 2026. Links available from the advisory page above.
3. U.S. Department of the Treasury, Office of Foreign Assets Control, Treasury Sanctions Technology Company for Support to Malicious Cyber Group, 3 January 2025. home.treasury.gov
4. CISA, Known Exploited Vulnerabilities catalogue, JSON feed, accessed 9 October 2026. cisa.gov/known_exploited_vulnerabilities.json
5. NIST, National Vulnerability Database, records for CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199 and CVE-2023-22894, accessed 9 October 2026. nvd.nist.gov
6. MITRE, ATT&CK Enterprise v19.2, STIX data, accessed 9 October 2026. github.com/mitre-attack/attack-stix-data
7. CISA, People’s Republic of China Threat Overview and Advisories, accessed 9 October 2026. cisa.gov/china