The latest joint cybersecurity advisory from CISA, the FBI, NSA and international partners highlights a concerning evolution in state-linked cyber operations. According to the advisory, Chinese government-linked threat actors, enabled by Integrity Technology Group, are combining automated vulnerability scanning, large-scale botnet infrastructure and hands-on exploitation techniques to compromise organizations across critical infrastructure sectors worldwide.

What makes these operations particularly concerning is the systematic combination of automation and targeted intrusion techniques. Attackers use automated tools to identify vulnerable internet-facing systems, exploit known software weaknesses, conduct password-spraying attacks against Microsoft Exchange and Microsoft 365 environments, and establish persistent access through VPN software and legitimate system utilities. Once inside, they can collect credentials, access sensitive communications and extract valuable organizational information while attempting to avoid detection.

The findings demonstrate that sophisticated cyber espionage does not necessarily depend on previously unknown vulnerabilities. Many attacks exploit older, publicly documented weaknesses, poorly secured remote access services and insufficient identity protection. The ability to combine these relatively conventional techniques with large-scale automation allows attackers to identify and compromise vulnerable organizations more efficiently.

For enterprises and critical infrastructure operators, this reinforces the importance of continuous attack-surface monitoring, timely vulnerability remediation, strong authentication, network segmentation and behavioral threat detection. Equally important is the ability to correlate seemingly unrelated activities, including vulnerability scanning, repeated authentication failures, suspicious VPN connections and unusual outbound data transfers, to identify coordinated attacks before significant damage occurs.

The broader concern extends beyond the organizations directly identified in the advisory. As cyber operations become increasingly automated and commercially supported, similar techniques can be directed against governments, businesses and critical services across geographical boundaries.

Cybersecurity can no longer focus exclusively on preventing initial intrusion. Organizations must also detect persistent access, identify abnormal network behavior and prevent unauthorized movement of sensitive information, even when attackers operate through legitimate tools and authenticated connections.

Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts. To help mitigate against this activity, organizations should prioritize disabling unused services and ports, sanitizing web application inputs to prevent injection attacks, implementing multifactor authentication for all services, and applying timely patches to reduce risks of compromise. Affected Products CVE-2014-6278 CVE-2015-3306 CVE-2015-5477 CVE-2016-3081 CVE-2019-11510 CVE-2021-22205 CVE-2021-3199 CVE-2023-22894 Key Actions Disable unused services and ports , such as automatic configuration, remote access, or file sharing protocols. Sanitize user input in web applications to prevent possible cross-site scripting (XSS) payload injection. Implement identity, credential, and access management (ICAM) policies , and then require multifactor

Source: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data via CISA Advisories — published 08 Oct 2026.