Joint advisory AA26-281A: Chinese “Integrity Technology Group” enabled actors
FBI, CISA, NSA, NCSC-UK, ASD’s ACSC, Canada’s Cyber Centre, Japan NPA and NCO, NCSC-NZ and Spain’s CNI say China-based Integrity Tech enables actors (TTPs...
- Disclosed
What happened
- FBI, CISA, NSA, NCSC-UK, ASD’s ACSC, Canada’s Cyber Centre, Japan NPA and NCO, NCSC-NZ and Spain’s CNI say China-based Integrity Tech enables actors (TTPs consistent with Flax Typhoon, Ethereal Panda, Red Juliett) who combine scanners, large botnets and hands-on exploitation against government, manufacturing, health, IT, law enforcement, education and religious organizations.
- Techniques: MicroScan (1,300+ exploit scripts), XSS payloads that draw fake login fields and drop malware, EBurst password spraying against Exchange/O365 interfaces (EWS, OWA, ActiveSync, Autodiscover and others), VPN-based persistence, scripted mail and credential exfiltration. CVEs listed include CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894.
- Attribution: the authoring agencies, based on multiple FBI investigations.
Live scores
Live scores
CVE-2014-6278- EPSS
- 0.997
very likely to be attacked soon - VEDAS
- 0.983
strong exploit evidence - On CISA KEV
- Yes, since 2025-10-02
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 46 days before CISA confirmed attacks.
Live scores
CVE-2015-3306- EPSS
- 0.995
very likely to be attacked soon - VEDAS
- 0.989
strong exploit evidence - On CISA KEV
- Yes, since 2026-10-08
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 61 days before CISA confirmed attacks.
Live scores
CVE-2015-5477- EPSS
- 0.996
very likely to be attacked soon - VEDAS
- 0.980
strong exploit evidence - On CISA KEV
- Yes, since 2026-10-08
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 417 days before CISA confirmed attacks.
Live scores
CVE-2016-3081- EPSS
- 0.965
very likely to be attacked soon - VEDAS
- 0.990
strong exploit evidence - On CISA KEV
- Yes, since 2026-10-08
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
VEDAS flagged this bug about 417 days before CISA confirmed attacks.
Live scores
CVE-2019-11510- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.983
strong exploit evidence - On CISA KEV
- Yes, since 2021-11-03
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2021-3199- EPSS
- 0.302
likely to be attacked soon - VEDAS
- 0.587
some exploit evidence - On CISA KEV
- Yes, since 2026-10-08
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.