AA26-281A advisory: Integrity Tech, Exchange, SoftEther, DCSync

On 8 October 2026 the FBI, CISA and NSA published joint advisory AA26-281A, co-sealed by the UK’s NCSC, the Australian Signals Directorate’s ACSC, the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, New Zealand’s NCSC and Spain’s Centro Nacional de Inteligencia.

At its centre is Integrity Technology Group (Integrity Tech), a for-profit company based in China with links to the Chinese government which, according to the authoring agencies, provides tools, infrastructure and people to China-linked malicious actors.

What happened

The information comes from several FBI investigations. The actors combine automated scanning, botnets, hands-on exploitation and VPN software to steal sensitive data, above all email and credentials. The activity is consistent with what is publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett, but the same actors may also carry out activity not linked to Integrity Tech.

In the United States the targeted sectors are government, critical manufacturing, healthcare and information technology, as well as law enforcement, education and religious organisations; other victims are in Southeast Asia, Africa and North America.

The UK NCSC’s announcement also mentions AI tools, “such as automated scanning”, and recalls that the UK government sanctioned Integrity Tech last year.

The attack chain

Reconnaissance (T1595.002). Open source tools such as Nmap, masscan, Fscan and dirsearch, mainly on ports 21, 22, 53, 80, 443 and 1080. Since at least 2017 the actors have also used MicroScan, a Python web application with more than 1,300 penetration testing scripts targeting OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins and Apache Struts.

Initial access. Since at least mid-January 2021 the actors have entered networks and cloud services mainly through command-line utilities built on exploit code in Python and Go (T1059.006). They also use cross-site scripting (T1189, T1059.007): the payload recovered by the FBI displays fake username and password fields, then offers a password-protected .zip archive containing the executable live700_v1.exe. This starts a process named DiagTrack.exe, like a legitimate Windows component (T1036.003), which communicates in encrypted form over HTTP with dns.studiocloud[.]xyz, a domain the FBI attributes to Integrity Tech. The program contains functions to query mailboxes.

Password spraying against Exchange. With the open source tool EBurst the actors attempt password spraying and password guessing (T1110.003, T1110.001) against Exchange and Office 365 accounts, through these interfaces: ECP, EWS, OAB, OWA, RPC, API, MAPI, PowerShell, Autodiscover and Microsoft-Server-ActiveSync.

Persistence (T1133). The actors install the SoftEther VPN client, downloaded with PowerShell or system binaries on Windows (T1059.001) and with curl or wget on Linux, and configure it to reconnect at startup. The installers are often named conhost.exe or dllhost.exe. Because it is legitimate software, the advisory notes, SoftEther is less likely to be flagged by endpoint detection tools. Among the domains and subdomains used for the SoftEther connections the advisory lists 98aiblog[.]com, hmbcloud[.]com, hmbcloud[.]net, hmbiplc-01[.]com, iepl.node[.]cm, javacheck.ooguy[.]com, javaupdate.giize[.]com, sexytube0[.]com and twimg.co[.]uk.

Collection and exfiltration.

• The PHP script Curlc4.txt uses the EWS API to retrieve email, calendars and contacts (T1114.002), compresses them and sometimes encrypts them with RC4 or AES-128-CBC (T1560.003), uploads them to a remote server (T1020) and renames its child process to crypto. Command and control: natcloudservice[.]com and upl.natcloudservice[.]com, address 149.28.132[.]137. Traces on disk: .run, clientid, cp, storage/fm and /var/tmp/.sess.zip.
• DC.exe performs a DCSync (T1003.006) against the domain controller, through RPC and the Directory Replication Service, and copies Active Directory credentials, group memberships and trust relationships.
• The office-cli utility (T1059.004) continuously accesses Outlook 365 mailboxes using configuration files that contain client_id, tenant_id and secret: it relies on legitimate access methods.

The FBI found email stolen from government bodies, law enforcement agencies, healthcare systems and religious institutions in Southeast Asia, in some cases accessible only from IP addresses in Xiamen, and a web application that gave third parties access to the stolen email.

The CVEs cited

Among the affected products the advisory lists eight CVEs, detailed in its Appendix B: CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199 and CVE-2023-22894. They are vulnerabilities published between 2014 and 2023.

Impact for European and Italian companies

The sources do not mention victims in Italy or Europe, but Spain and the United Kingdom co-sign the advisory and the techniques described involve very widespread technologies: Exchange and Microsoft 365 email, Active Directory, exposed web applications. The main target is email, which in a company holds credentials, contracts and personal data. Healthcare is among the targeted sectors. For NIS2 entities, a compromise of this kind must also be assessed against the notification obligations, and against the GDPR if personal data is involved.

What to do now

The key actions recommended by the authoring agencies:

1. Disable unused services and ports, such as automatic configuration, remote access and file sharing protocols.
2. Sanitise input in web applications to prevent XSS payload injection.
3. Adopt identity, credential and access management policies and require multi-factor authentication for services, where possible.

For detection:

4. Download the indicators from the advisory’s STIX files and search for them in DNS, proxy, firewall and mail logs.
5. Look for failed sign-ins spread across many accounts, on all the Exchange interfaces listed.
6. Look for unauthorised SoftEther installations and for processes named conhost.exe, dllhost.exe or DiagTrack.exe that are not the genuine Windows components.
7. Review the apps registered in your Microsoft 365 tenant and their secrets, and Active Directory replication requests coming from machines other than domain controllers.

If you find signs of compromise, the advisory says to isolate the affected hosts and start threat hunting, collecting artefacts and logs.

How ARXDOME helps

ARX Horizon lets you search for indicators of compromise from the portal. ARX Sentry groups failed sign-ins, bursts of attempts, suspicious executions and persistence in the SOC pages, and its software and process inventory helps you find a VPN client installed without authorisation. ARX Expose shows exposed services with known vulnerabilities and ARX Shield isolates a suspicious machine from the network.

Last updated: 9 October 2026