RESOURCE
Joint advisory AA26-281A, cosigned by the Canadian Centre for Cyber Security and partners in six other countries, says actors enabled by China's Integrity Technology Group combine automated scanning, large botnets and manual exploitation to steal sensitive data from organizations worldwide, including critical infrastructure.
Fabric Networks
Start with a conversation about your cryptographic posture.
On October 8, 2026 the FBI, CISA, NSA and the UK's NCSC published joint cybersecurity advisory AA26-281A with the Canadian Centre for Cyber Security and agencies in Australia, Japan, New Zealand and Spain. It describes Chinese government linked actors, enabled by the Integrity Technology Group, combining automated scanning tools, large botnets and manual exploitation to steal sensitive data from organizations worldwide, including critical infrastructure.
The techniques are not exotic. The actors use scanning, cross site scripting and password spraying against Microsoft Exchange servers, exploit vulnerabilities with identifiers going back to 2014, establish persistence by installing legitimate VPN client software on victim machines, and package stolen email and credentials for exfiltration. The advice is to disable unused services and ports (including remote access, automatic configuration and file sharing), require multifactor authentication, segment edge devices and patch promptly.
This campaign is about taking data now, at scale, through doors that have been open for years. Some of what leaves is encrypted, and what cannot be read today can be kept. The first defence is knowing what is exposed: which edge devices, which remote access paths, which protocols and which keys. You can't fix what you can't see. Disable, isolate or tunnel, not run alongside.