Australian and international cyber security agencies have issued a joint warning detailing how Chinese government-linked threat actors are combining large-scale automated scanning, legitimate network administration tools and targeted intrusions to compromise organisations and steal sensitive information.
The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) has joined international intelligence and law enforcement partners in issuing a cyber security advisory describing the techniques used by Chinese government-linked cyber threat actors to infiltrate networks, maintain persistent access and extract sensitive data.
The advisory, published on 9 October 2026, identifies China-based Integrity Technology Group (Integrity Tech) as a company with links to the Chinese government that provides infrastructure, tools and services used to support malicious cyber operations against organisations internationally.
The findings draw on technical evidence recovered during multiple investigations by the United States Federal Bureau of Investigation (FBI), describing what agencies said was an extensive cyber espionage ecosystem combining automated vulnerability discovery with hands-on exploitation and data theft.
According to the advisory, the threat actors have targeted government agencies, critical manufacturing, healthcare, information technology, law enforcement, educational institutions and religious organisations. Victims have been identified across the United States, Southeast Asia, Africa and North America.
The joint warning was issued by the FBI, Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), the United Kingdom’s National Cyber Security Centre, the ACSC and partner agencies in Canada, Japan, New Zealand and Spain.
The investigation identifies tactics consistent with threat groups publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett, although authorities caution that the activities of these groups do not necessarily correspond directly with Integrity Tech’s operations.
A central finding is the use of a combination of large-scale botnets, virtual private network infrastructure, legitimate system utilities and specialised exploitation tools to identify vulnerable networks and conduct cyber espionage.
The actors employ publicly available scanning tools, including Nmap, masscan and dirsearch, alongside a Python-based application known as MicroScan. The latter contains more than 1,300 penetration-testing scripts designed to identify vulnerabilities in widely deployed enterprise software and internet-facing services.
These automated capabilities allow attackers to identify potentially vulnerable organisations before conducting more targeted intrusions.
Investigators also identified attacks against Microsoft Exchange and Microsoft 365 environments, including password spraying and credential-guessing attempts using a tool known as EBurst.
In some cases, malicious cross-site scripting code was used to present fraudulent credential-entry fields to users, enabling attackers to capture usernames and passwords and deliver additional malicious software.
Once inside a network, the threat actors frequently exploit legitimate administrative tools to avoid detection. This technique, commonly known as living off the land, allows malicious activity to blend with normal system operations.
The advisory identifies the use of SoftEther VPN software to establish persistent remote access to compromised devices. Attackers configure the software to reconnect automatically, allowing continued access even after an initial intrusion.
Because SoftEther is legitimate software, its presence may not immediately trigger endpoint security alerts.
The FBI also observed attackers extracting information from email systems and databases, including the use of scripts capable of accessing Microsoft Exchange Web Services to retrieve emails, calendars and contacts.
Stolen information was sometimes compressed or encrypted before being transferred to attacker-controlled infrastructure, while file names were disguised to resemble ordinary website resources.
The findings highlight the increasing difficulty organisations face in distinguishing legitimate administrative activity from malicious operations, particularly when attackers combine widely available tools with purpose-built capabilities.
The advisory is particularly relevant to Australian organisations operating across government, critical infrastructure and the broader Indo-Pacific region.
Although the document identifies victims in Southeast Asia, it does not publicly confirm specific Australian organisations compromised through the activity described.
The warning follows separate international advice issued in September concerning China-linked cyber actors increasingly using networks of compromised routers and internet-connected devices to conceal their operations and support sustained access to targeted systems.
That earlier advisory highlighted the limitations of traditional detection methods based on known malicious IP addresses, particularly when attackers can rapidly change their infrastructure.
Australian organisations are being urged to review the newly published indicators of compromise, investigate unusual account activity and network connections, and strengthen identity and access controls.
Recommended measures include enforcing multifactor authentication, promptly patching internet-facing systems, restricting unnecessary services, monitoring privileged accounts and investigating unexpected data transfers.
The agencies also recommend monitoring Active Directory replication activity, reviewing cloud applications with access to sensitive information and testing existing security controls against the techniques documented in the MITRE ATT&CK framework.
Organisations that identify potential compromise are advised to isolate affected systems, preserve relevant forensic evidence, investigate the extent of unauthorised access and implement coordinated measures to remove attackers from their environments.
The advisory reinforces concerns about the growing scale and sophistication of state-linked cyber espionage, with attackers increasingly combining automation, legitimate software and specialised tools to conduct sustained intelligence collection.
For Australian security teams, the findings underscore the importance of moving beyond perimeter protection towards continuous monitoring, proactive threat hunting and the ability to detect suspicious behaviour occurring through otherwise legitimate systems and accounts.
