Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

A joint cybersecurity advisory published on October 8, 2026, by an international coalition of agencies—including the FBI, CISA, NSA, UK NCSC, ASD's ACSC, Canada's Cyber Centre, Japan's NPA, New Zealand's NCSC-NZ, and Spain's CNI—warns of Chinese government-linked threat actors combining automated and hands-on hacking tools to steal sensitive data. The threat actors are enabled by Integrity Technology Group, a China-based company with links to the Chinese government.

The actors employ a mix of large-scale botnets, automated scanning tools, and living-off-the-land (LOTL) techniques to conduct network reconnaissance and initial access. Exploitation methods include the use of scanning tools, cross-site scripting (XSS) attacks, and password spraying targeting Microsoft Exchange servers. Persistence is established through VPN software, and exfiltration of emails and credentials is accomplished using scripts.

Victims have been identified across multiple US critical infrastructure sectors, including Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. Additional targets include US law enforcement, education, and religious organizations, as well as entities in Southeast Asia, Africa, and North America.

The advisory attributes the activity to technical evidence recovered from and observed during multiple FBI investigations related to Integrity Technology Group. The coalition urges network defenders to hunt for potential compromises, disable unused services and ports, sanitize web application inputs, implement multifactor authentication (MFA), and apply timely patches to reduce the risk of compromise.