CISA and international partners issued a joint advisory on China-linked activity enabled by Integrity Technology Group. The agencies say the actors combined automated scanning, botnets, VPN infrastructure and hands-on intrusion techniques to target sensitive data across critical-infrastructure sectors and other organizations worldwide.
The advisory describes reconnaissance and exploitation of internet-facing services, password spraying against Microsoft Exchange, persistence, and email and credential collection. It includes indicators and mitigation guidance based on FBI investigations.
Defender actions
- Hunt using the advisory’s indicators across identity, web, VPN and mail telemetry.
- Remove or restrict unnecessary exposed services and management interfaces.
- Apply patches and require MFA for externally reachable services.
- Monitor for scanning, password spraying and unusual mailbox collection.
This is a call to compare published behaviors with local evidence, rather than evidence that every organization using the named technology has been compromised.
Source: CISA advisory AA26-281A (October 8, 2026).