China-Linked Operators Blend Botnets, Phishing, and Hands-On Intrusions

China-Linked Operators Blend Botnets, Phishing, and Hands-On Intrusions

U.S. and allied agencies have released a new joint advisory on China-linked cyber activity enabled by Integrity Technology Group, a Beijing-based company tied by investigators to activity tracked publicly as Flax Typhoon, Ethereal Panda, and RedJuliett. The advisory, published on October 8, details a practical intrusion model: automated scanning and large botnets find exposed targets, then operators switch into hands-on exploitation, persistence, email theft, and credential collection.

The timing matters because the advisory landed alongside a Justice Department and FBI disruption of two Integrity Tech-operated platforms, MicroScan and FishHub. Those tools were allegedly used to scan and, in some cases, compromise U.S. and foreign critical infrastructure, universities, NGOs, and technology-sector networks.

For defenders, this is not just another attribution story. It is a useful map of how automated reconnaissance, password attacks, legitimate VPN tooling, and targeted data theft can combine into one repeatable access pipeline.

What the advisory says

The joint advisory says Integrity Tech-enabled actors have targeted government, critical manufacturing, healthcare, IT, education, law enforcement, religious organizations, and other victims across multiple regions. The actor set uses a mixture of open source scanners, custom tooling, botnet infrastructure, phishing, cross-site scripting payloads, Microsoft Exchange password spraying, and living-off-the-land techniques.

MicroScan is especially important. According to the advisory, it is a Python-based web application with more than 1,300 penetration-testing scripts used to scan websites for known weaknesses across products such as OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. That gives operators a fast way to identify internet-facing systems where old flaws may still be exploitable.

FishHub represents the follow-on access problem. The Justice Department says it facilitated exploitation through spear phishing and could download additional malware after an initial compromise, giving operators remote access or helping them search for specific files and send them to Integrity Tech-controlled servers.

The intrusion pattern

The campaign should be read as a playbook rather than a single tool story:

1. Scan broadly for exposed services and known weaknesses.
2. Exploit reachable systems or use credential attacks against Microsoft Exchange and Office 365 interfaces.
3. Establish persistence with legitimate VPN software, especially SoftEther, often renamed to resemble common Windows executables.
4. Collect mail, credentials, databases, or files of interest.
5. Compress and exfiltrate data through attacker-controlled infrastructure.

That sequence is familiar, but the scale is the point. Automated tooling helps find targets quickly, while human operators appear to step in when the access is valuable enough to justify deeper collection. This is why the issue belongs in threat intelligence and detection queues, not only patch queues.

What defenders should hunt for

Security teams should prioritize signs of the workflow described in the advisory:

• Unusual scanning against web applications, especially enumeration of PHP or ASP/.NET pages.
• Password spraying against Exchange interfaces such as OWA, EWS, ECP, ActiveSync, MAPI, Autodiscover, PowerShell, and related APIs.
• SoftEther VPN clients appearing unexpectedly on servers or endpoints.
• Suspicious binaries renamed as conhost.exe, dllhost.exe, or other legitimate-looking Windows process names.
• Web shells, scripts, or staged archives using image-like or JavaScript-like filenames.
• Connections to infrastructure and indicators listed in AA26-281A.
• Mailbox access patterns that suggest bulk export, compression, or scripted collection.

The actor's use of legitimate tools is a reminder that endpoint alerts alone may not be enough. Network telemetry, authentication logs, VPN inventory, email audit logs, and exposed service inventories all matter here.

Immediate defensive actions

The advisory's first-order mitigations are practical:

• Disable unused services and ports, especially remote access, file sharing, and automatic configuration services.
• Sanitize user input in web applications to reduce cross-site scripting exposure.
• Enforce multi-factor authentication across external and administrative services.
• Patch known exploited and internet-facing vulnerabilities quickly.
• Review externally exposed assets for end-of-life systems and forgotten services.
• Monitor Exchange and Office 365 authentication for spraying and guessing attempts.
• Validate that VPN clients and remote access tools are approved, named correctly, and tied to business owners.

Teams should also ingest the advisory's IOCs into detection tooling, but IOCs should be treated as a starting point. The more durable value is the behavioral model: broad scanning, credential pressure, legitimate VPN persistence, and focused data theft.

Why this matters

This case shows how state-linked operations increasingly look like an industrial pipeline. Contractors and enabling companies can supply scanning, infrastructure, access tooling, and operational support, while government-linked actors benefit from scale and deniability.

For defenders, the lesson is blunt: exposed legacy services, weak identity controls, and unmanaged remote access tooling remain high-value entry points. The best response is not only blocking a list of domains. It is reducing the reachable attack surface, tightening identity controls, and hunting for the operational behaviors that remain after infrastructure is disrupted.

References

1. FBI, CISA, NSA, NCSC-UK, ACSC, Canadian Centre for Cyber Security, Japan NPA/NCO, NCSC-NZ, Spain CNI
2. U.S. Department of Justice
3. Associated Press