Joint advisory AA26-281A was published on 8 October 2026 by ten agencies including ASD's ACSC and the FBI. It says actors enabled by China-based Integrity Technology Group pair automated scanning with hands-on exploitation. They target web applications and Microsoft Exchange accounts, then keep access through SoftEther VPN software.
Key takeaways
- Ten agencies from seven countries authored it.
- The advisory names Integrity Technology Group as the enabler.
- MicroScan has been in use since as early as 2017.
- Persistence uses legitimate SoftEther VPN software.
- Indicators of compromise are published as STIX files.
Who wrote it and why it matters here
The authoring agencies are:
- United States: FBI, CISA and NSA
- United Kingdom: NCSC-UK
- Australia: ASD's ACSC
- Canada: Canadian Centre for Cyber Security
- Japan: National Police Agency and National Cybersecurity Office
- New Zealand: NCSC-NZ
- Spain: Centro Nacional de Inteligencia
The advisory says its technical content comes from multiple FBI investigations.
It names US targets in government services, critical manufacturing, healthcare and IT. It also lists victims in Southeast Asia, Africa and North America.
How the intrusions work
Scanning. The actors use open source scanners such as Fscan, masscan, NMAP and wpscan. The advisory lists the ports they focus on: 21 22 53 80 443 1080.
MicroScan. A Python web application with over 1,300 penetration testing scripts. The advisory lists targets including Oracle WebLogic, WordPress, Jenkins and Apache Struts.
Cross-site scripting. Since at least mid-January 2021, the actors have used XSS payloads that show a fake login and capture whatever credentials are typed.
EBurst. An open source tool for password spraying and guessing against Exchange interfaces, including Exchange Web Services and the Exchange Control Panel.
SoftEther. Installers are often renamed conhost.exe or dllhost.exe and set to reconnect on startup. The advisory notes endpoint tools are less likely to flag SoftEther because it is legitimate VPN software.
What the authors recommend first
The advisory's key actions are:
- Disable unused services and ports.
- Sanitise user input in web applications to stop XSS.
- Require multi-factor authentication, especially for webmail and VPNs.
- Patch promptly and replace end-of-life products.
It also asks defenders to review web access logs for traversal, injection and enumeration attempts.
Sorami’s view
This section is opinion. It is our reading for small Australian teams, not part of the advisory.
Nothing in AA26-281A needs a novel defence. The entry points are exposed ports, an XSS bug and a mailbox without multi-factor authentication. That makes it a good test of whether your basics hold, because the tooling looks for the weakest target it can find.
The SoftEther detail is the one to act on this week. Search your endpoints for SoftEther processes and for conhost.exe or dllhost.exe running outside the Windows system folder.
What to do now
- Scan your own internet ranges for the ports the advisory lists.
- Confirm multi-factor authentication on webmail, VPN and admin accounts.
- Test public web forms for cross-site scripting.
- Hunt for SoftEther and renamed system binaries on endpoints.
- Load the STIX indicators into your detection tooling.
To test a public application for XSS and credential attacks, see web application penetration testing, or contact us to discuss scope.
Related guides
- ASD Cyber Action Year 2026: the five critical actions
- What a penetration test report should contain
- Every Sorami article is in the guides index.
Sources
- CISA and partners, AA26-281A: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (8 October 2026)
- AA26-281A full advisory (PDF)
- NCSC New Zealand, alert on the joint advisory
Facts on this page were checked against these sources on 12 October 2026. We update the page when the source changes.