Reported by 2 outlets
CISA AA26-281A advisory: Chinese government-linked actors with FBI and international partners
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.09 / 0.6 · time to second source
- Recency
- × 0.14 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Analysis
CISA advisory AA26-281A, published October 8 with FBI, NSA and international partners, links Chinese government-linked actors tracked as Flax Typhoon (Integrity Tech / Ethereal Panda / Red Juliett) to campaigns against US critical infrastructure and organizations in Southeast Asia, Africa, and North America. Initial access uses XSS credential-harvesting pages that deliver DiagTrack.exe malware combined with EBurst password spraying against Exchange. Actors maintain persistence with SoftEther VPN clients disguised as conhost.exe or dllhost.exe for stealthy remote access. Post-access activity includes Curlc4.txt and office-cli email collection paired with DCSync credential harvesting via DC.exe.
The advisory matters because it documents hands-on intrusion combined with automated reconnaissance rather than generic malware distribution. The multi-agency attribution (FBI, NSA, UK, Australia, Canada, Japan, New Zealand, Spain) and named infrastructure targets elevate it above typical threat-intel marketing. Watch for any CISA KEV additions or vendor detection updates tied to DiagTrack.exe and the disguised SoftEther clients, and for confirmation of which US critical-infrastructure sectors have been impacted.
Timeline
-
original reporting
CISA AA26-281A: Chinese government-linked actors with FBI, NSA, and agencies from UK, Australia, Canada, Japan, New Zealand, and Spain
www.cisa.gov · 2d ago · October 11th, 2026
[1/2] CISA AA26-281A, with FBI, NSA and partner agencies from UK, Australia, Canada, Japan, New Zealand and Spain: Chinese government-linked actors, ...
via Mastodon https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
-
update from malware.news
CISA AA26-281A: How Chinese Government-Linked Actors Steal Sensitive Data
malware.news · 4d ago · October 9th, 2026
Key Takeaways CISA links China-based Integrity Tech to activity tracked as Flax Typhoon , also called Ethereal Panda or Red Juliett. Targets include US critical infrastructure and organizations in Southeast Asia, Africa, and North America. Initial access combines XSS credential-harvesting pages delivering DiagTrack.exe malware with EBurst password spraying against Exchange. Actors install SoftEther VPN clients disguised as conhost.exe or dllhost.exe to maintain stealthy, startup-persistent remote access. Data theft combines Curlc4.txt and office-cli email collection with DCSync credential harvesting through DC.exe . The Picus Platform simulates Flax Typhoon threats to validate security controls against these attacks. CISA published a joint cybersecurity advisory on October 8, 2026, which describes how Chinese government-linked threat actors combine automated reconnaissance with hands-on intrusion to steal sensitive data.