U.S. and Allies Say China-Linked Hackers Got In Through Old Software and Guessed Email Passwords

Not every serious hack starts with a brand-new flaw. On Thursday, October 8, 2026, the FBI, CISA, NSA and agencies from six other countries published a joint advisory describing hackers who broke into organizations through software problems that were fixed as long as 12 years ago, and through email accounts with guessable passwords.

The agencies say the activity was enabled by Integrity Technology Group, which they describe as a China-based company with links to the Chinese government. The same day, the Justice Department announced court-authorized seizures of domains used to run two of the tools.

The advisory is written for government and critical infrastructure, but the techniques it describes work against any business with an email account and a website.

What the agencies say happened

The advisory is based on what it calls “technical evidence recovered from, and observed during, multiple Federal Bureau of Investigation (FBI) investigations.” According to the agencies:

They scanned for easy targets. The actors used common open-source scanning tools and a web application called MicroScan, which the advisory says the actors have used since at least 2017 and which contains “over 1,300 penetration testing scripts” for finding known weaknesses in websites and services, including WordPress, Jenkins and Apache Struts.
They exploited old flaws. The advisory lists eight vulnerabilities that were “successfully exploited,” dating from 2014 to 2023. They affect the Bash command shell, the ProFTPD file transfer server, BIND DNS servers, Apache Struts, Pulse Connect Secure VPNs, GitLab, ONLYOFFICE document servers and the Strapi website content system.
They guessed email passwords. The actors used an open-source tool to try passwords against Microsoft Exchange and Office 365 accounts through many different connection points, including Outlook on the web, Exchange Web Services, ActiveSync and Autodiscover.
They hid behind legitimate software. To keep access, the actors installed SoftEther, a legitimate VPN program, on victims’ computers, often under names like conhost.exe or dllhost.exe so it would look like part of Windows. The advisory notes that security software “is less likely to flag SoftEther because it is a legitimate VPN software.”
They took email. The FBI says it saw the actors pull data from victims’ mailboxes, including through a script built to read mail, calendars and contacts.

The agencies say the targets included government, manufacturing, healthcare and IT organizations, as well as law enforcement, education and religious organizations. The UK’s National Cyber Security Centre, one of the co-authors, said the UK had already sanctioned Integrity Tech in 2025.

What the FBI seized

According to the Justice Department, the seizures target MicroScan and a second tool, FishHub, which court documents allege was used to break into networks through targeted phishing emails. The department says MicroScan’s scanning targets included a U.S. power company in South Carolina, airports in Japan and Poland, and energy companies in Taiwan, and that about 20 Taiwanese universities were confirmed FishHub victims.

The department calls this its second public disruption of Integrity Tech’s infrastructure, after a 2024 operation against a botnet of more than 200,000 consumer devices. The claims about Integrity Tech come from government advisories and court documents. They are allegations, and the seizure is not a criminal conviction. We did not find a public response from Integrity Tech as of October 8.

A seizure takes specific domains offline. It doesn’t patch anyone’s servers or change anyone’s passwords, which is why the advisory focuses on what defenders should do.

The deadline that doesn’t apply to you, and the lesson that does

CISA added five of the eight flaws to its Known Exploited Vulnerabilities catalog on October 8, with a remediation due date of Sunday, October 11, 2026. That deadline is binding on federal civilian agencies, not on private businesses.

The useful point for everyone else is how old these flaws are. The newest is from 2023 and the oldest from 2014. Fixes have existed for years. If any of this software is still running unpatched, it’s usually on a forgotten server, an old website, or a device nobody owns anymore.

What to check

1. Email sign-in. Password guessing only works when a correct password is enough to get in. The advisory recommends multifactor authentication (MFA, a second step such as an app approval) “for all services (to the extent possible), particularly for webmail, VPNs, and accounts that access critical systems.”

On Microsoft 365, Microsoft says MFA and blocking legacy authentication stop “more than 99.9%” of common identity attacks. Legacy authentication means older connection methods, such as some IMAP, POP and SMTP setups, that can’t do MFA. If you don’t use Conditional Access, check that security defaults are on: in the Microsoft Entra admin center, go to Entra ID > Overview > Properties > Manage security defaults (Microsoft Learn). If you use Conditional Access, confirm a policy blocks legacy authentication. Before switching either on, check whether a copier, scanner or old app sends email with a plain password; Microsoft’s page links to guidance for those devices.
If you still run your own Exchange server, its webmail and other connection points face the internet, and those are the interfaces the advisory lists. Microsoft’s lifecycle pages show that support for Exchange Server 2016 and Exchange Server 2019 ended in October 2025. The advisory recommends replacing end-of-life products with supported ones.

2. What your business exposes to the internet. The actors focused on file transfer (FTP), remote login (SSH), DNS, websites and proxy ports, according to the advisory. Ask your IT provider for a plain list of every service reachable from the internet, who owns it, and when it was last updated. The advisory’s first recommendation is to “disable unused services and ports.”

3. Your website and its hosting. Several of the listed flaws live in web software. Ask whoever runs your website whether the server or any add-on uses Apache Struts, Strapi, ONLYOFFICE, GitLab or ProFTPD, and whether they’re current. Keep WordPress and its plugins updated (see our WordPress checklist). The advisory also calls out cross-site scripting, a type of website flaw where an attacker’s code runs in a visitor’s browser, which in this case was used to show fake login boxes.

4. VPN software you didn’t install. Ask your IT provider to look for SoftEther or other VPN clients that aren’t on your approved list, especially copies named like Windows system files. Unapproved remote-access software is worth investigating no matter who put it there.

5. Basics that limit the damage. The advisory also recommends replacing default passwords, keeping admin accounts to the people who need them, filtering malicious websites at the DNS level, and keeping backups that can’t be changed or deleted from the systems they protect.

If you find something

Don’t wipe a suspicious computer or server before you or your provider have recorded what’s on it. Disconnect it from the network and get help. U.S. organizations can report to the FBI through IC3 or to CISA at 1-844-729-2472, as the advisory lists. If customer data or money may be involved, call your cyber insurer.

If you’d like help building that list of internet-facing systems or checking your Microsoft 365 sign-in settings, NightSquawk Tech offers a free assessment.

Sources

FBI, CISA, NSA, NCSC-UK, ASD’s ACSC, Canadian Centre for Cyber Security, Japan NPA and NCO, NCSC-NZ and Spain’s CNI, “Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data,” advisory AA26-281A, CISA, Oct. 8, 2026. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
CISA, “CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide,” press release, Oct. 8, 2026. https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat
U.S. Department of Justice, Office of Public Affairs, “Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored Hackers,” press release 26-1155, Oct. 8, 2026. https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-vulnerability-scanning-and-spear-phishing-tools-operated
UK National Cyber Security Centre, “China-linked malicious actors called out by UK and international partners for targeting sensitive data globally,” Oct. 8, 2026. https://www.ncsc.gov.uk/news/china-linked-actors-called-out-by-uk-and-international-partners-for-targeting-sensitive-data
CISA, “Known Exploited Vulnerabilities Catalog,” catalog version 2026.10.08. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Microsoft Learn, “Configure security defaults for Microsoft Entra ID.” https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
Microsoft Learn, “Block legacy authentication with Conditional Access.” https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication
Microsoft Lifecycle, “Exchange Server 2016.” https://learn.microsoft.com/en-us/lifecycle/products/exchange-server-2016
Microsoft Lifecycle, “Exchange Server 2019.” https://learn.microsoft.com/en-us/lifecycle/products/exchange-server-2019

Editorial note: This article was drafted with AI assistance from the government advisories and Microsoft documentation linked above. Claims about Integrity Technology Group are attributed to the authoring agencies and the Justice Department. NightSquawk Tech did not independently investigate this activity. Setting names are as documented on October 8, 2026, and may change.