Daily Surveillance Briefing: October 12, 2026

CISA, FBI, NSA and seven allied agencies published AA26-281A on October 8, 2026, mapping the Flax Typhoon toolchain against US critical infrastructure: open-source and bespoke scanning, password spraying against Microsoft Exchange, persistent SoftEther VPN, mailbox theft via the EWS API, and Outlook 365 exfiltration. The advisory names four US critical-infrastructure sectors, eight CVEs going back to 2014, and a one-line attribution to a company the September 2024 NSA/FBI advisory already tied to the 260,000-device botnet.

State of Surveillance

Today in Surveillance:

  • CISA, FBI, NSA and seven allied agencies published AA26-281A on October 8, mapping Flax Typhoon's full toolchain against US critical infrastructure. The joint advisory lists four US critical-infrastructure sectors (Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, Information Technology) plus US law enforcement offices, education institutions, and religious organizations. It ties the activity to a "China-based for-profit" company, and it lists eight CVEs going back to 2014 that the actor has been seen exploiting [1].
  • The advisory gives the public a one-line attribution to the botnet operator the September 2024 NSA/FBI advisory already named. AA26-281A's TTP list and IOC set match the activity the joint NSA, FBI and CNMF advisory tied to Integrity Technology Group on September 18, 2024, when the FBI disrupted a botnet of more than 260,000 compromised devices and a management database with more than 1.2 million records, including more than 385,000 unique US victim devices [2][3][4].
  • CISA's April 2026 AA26-113A had already named the "Raptor Train" covert network Flax Typhoon used. The April 23, 2026 advisory said the covert network infected more than 200,000 devices worldwide and consisted of small-office home-office routers, IoT devices, firewalls, and Network Attached Storage. AA26-113A is the first government advisory to attribute the network to Integrity Technology Group "as assessed by the FBI" [5].
  • The Flax Typhoon toolkit the advisory catalogs reads like a checklist of every perimeter weakness a typical organization leaves open. Open-source scanners (BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, wpscan) on ports 21, 22, 53, 80, 443, and 1080; a Python pentest framework called MicroScan with 1,300-plus scripts; an Exchange password-spray tool called EBurst; persistent SoftEther VPN tunnels renamed to mimic Windows binaries; a domain-controller-replication tool called DC.exe; and an Outlook 365 exfiltration tool called office-cli [1][5].

Continuing threads: The October 8 AA26-281A formalizes the same tradecraft the September 2024 takedown documented. The site's Volt Typhoon tracker tracks the related PRC state-linked APT; yesterday's daily briefing for October 11 carries the parallel Wyden-HIDTA, EFF, Denmark-CPR, TP-Link, and iPhone-bypass threads.

CISA and Allies Publish the First Joint Toolchain Advisory Against Flax Typhoon

CISA, the FBI, NSA and seven international partners released AA26-281A on October 8, 2026. The signing agencies are CISA, FBI, NSA, the UK's NCSC, Australia's ACSC, the Canadian Centre for Cyber Security, Japan's NPA and NCO, New Zealand's NCSC, and Spain's CNI. The advisory gives a public-sector reading of how Flax Typhoon gets in, what it does once it is in, and where it has been. The tradecraft is broken into MITRE technique IDs and named for the specific tools used [1][5].

The sectors the advisory names are the closest thing to a victim list. AA26-281A lists US critical-infrastructure targets as Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. Outside those sectors, the advisory adds US law enforcement offices, education institutions, and religious organizations, and reaches Southeast Asia, the African continent, and North America more broadly. The advisory does not name any individual victim organization [1].

The tradecraft starts cheap and gets expensive. The actor runs open-source scanners against the public internet on ports 21, 22, 53, 80, 443, and 1080. MicroScan, a Python pentesting framework with 1,300-plus scripts, is the actor's bespoke enumeration tool. AA26-281A pairs the open-source stack with a custom Windows binary called live700_v1.exe and a renamed DiagTrack.exe that beacon to dns.studiocloud.xyz. Once a target responds, the actor swaps to hands-on exploitation [1].

Two Microsoft Exchange attack chains follow. The first is password spray and credential stuffing against Exchange endpoints (ECP, EWS, OAB, OWA, RPC, the API, MAPI, PowerShell, Autodiscover, ActiveSync) using a tool the advisory names EBurst. The second is mailbox theft via the EWS API using Curlc4.txt, a PHP bot that compresses and encrypts mailbox contents with RC4 or AES-128-CBC, stages the archives, and exfiltrates them. Persistence is established with SoftEther VPN clients renamed to conhost.exe or dllhost.exe and configured to auto-reconnect. The actor's DC.exe runs DCSync against a domain controller to walk out the whole credential database. The actor's office-cli tool then drives Microsoft Outlook 365 to perform the actual exfiltration at scale [1].

The CVEs the actor has been seen exploiting span a decade. AA26-281A lists GNU Bash (CVE-2014-6278), ProFTPD (CVE-2015-3306), ISC BIND 9.x (CVE-2015-5477), Apache Struts (CVE-2016-3081), Pulse Connect Secure (CVE-2019-11510), GitLab (CVE-2021-22205), ONLYOFFICE DocumentServer (CVE-2021-3199), and Strapi (CVE-2023-22894). A 2026 actor using 2014-era bugs means an unpatched system from any year is in scope. AA26-113A's broader China-nexus guidance covers the same tradecraft under MITRE ATT&CK technique IDs T1584.005, T1584.008, T1090.003, and T1583.003 [1][5].

The Botnet Operator's Name Is Already on the Public Record

AA26-281A ties the activity to a "China-based for-profit" company using TTPs already attributed to Flax Typhoon, Ethereal Panda, and Red Juliett. The September 18, 2024 joint NSA, FBI, and CNMF advisory went one step further and named the company directly: Integrity Technology Group, which the 2024 advisory describes as a "PRC-based company with ties to the PRC government." The same advisory says Integrity Technology Group "has controlled and managed a botnet active since mid-2021," with command-and-control infrastructure overlapping China Unicom Beijing Province Network IP addresses [2][3].

FBI Director Christopher Wray announced the link publicly at the Aspen Cyber Summit on September 18, 2024, and the US Department of Justice announced the same-day court-authorized operation that disrupted the botnet. The botnet "reached over 260,000 devices by June 2024" with a MySQL management database "containing over 1.2 million records of compromised devices, including over 385,000 unique U.S. victim devices," according to the joint advisory. The 260,000-device count and the 385,000-US-victim count are the public-record numbers AA26-281A updates, not replaces [2][3][6].

The 2024 advisory also names three industry labels for the same activity: Flax Typhoon, RedJuliett, and Ethereal Panda. AA26-281A repeats the three-label list. Whether Integrity Technology Group is a contractor to the PRC Ministry of State Security, an arm of it, or a private firm the government uses without a formal line, is not stated in either advisory. The September 2024 advisory calls Integrity Technology Group "a PRC-based company with ties to the PRC government" and stops there [1][2].

The April 2026 Advisory Put a Name to the Covert Side

CISA's AA26-113A, published April 23, 2026, is the first public advisory to attribute a separate covert Flax Typhoon network to Integrity Technology Group. The advisory names the covert network "Raptor Train" and says it infected more than 200,000 devices worldwide. Raptor Train consisted of "thousands of SOHO routers and IoT devices, such as web cameras and video recorders, as well as firewalls and Network Attached Storage (NAS) devices," and it is distinct from the 260,000-device botnet the September 2024 takedown disrupted. AA26-113A does not name specific victim organizations [5].

The tradecraft underneath Raptor Train is the same layered build AA26-281A documents. Cheap automated scanning identifies exposed targets, custom Python enumeration (MicroScan) maps them, password spraying (EBurst) walks Exchange credentials, persistent SoftEther tunnels maintain access, and the DCSync attack on a domain controller pulls the entire credential store. CISA's AA26-113A and AA26-281A are two views of the same operator, separated by six months and one major advisory [1][5].

Both advisories share the same C2 domain pattern. AA26-281A lists dns.studiocloud.xyz, studiocloud.xyz, natcloudservice[.]com, twimg.co[.]uk, ooguy[.]com, giize[.]com, 96html[.]com, sexytube0[.]com, and hmbiplc-01[.]com, plus one IP, 149.28.132[.]137. AA26-113A's broader China-nexus guidance adds Botnet-as-a-Service (T1584.005) and Network-Device-as-a-Service (T1584.008) to the MITRE framework, with the botnet accessed through multi-hop proxies (T1090.003) running on virtual private server infrastructure (T1583.003) [1][5].

What Defenders Are Told To Do

AA26-281A's defensive recommendations are the perimeter-hardening basics, and the actor's tradecraft depends on those basics not being done. The advisory lists the actions in order: disable unused services and ports; sanitize user input to prevent reflected XSS on login pages; enroll phishing-resistant MFA on webmail, VPN, and admin paths; patch exposed vulnerable services, including appliances and end-of-life operating systems; monitor for unauthorized Active Directory replication requests; enable protective DNS at the resolver level; watch for renamed SoftEther and renamed legitimate utilities outside expected paths; apply network segmentation between mail servers and the rest of the network; use ICAM policies; replace default passwords; engage third-party penetration testing; and maintain offline, password-protected backups [1].

The reporting path for organizations that find activity the advisory describes is CISA's 24/7 Operations Center at [email protected] or 1-844-Say-CISA, or the local FBI field office. Outside the United States, the international signers (NCSC-UK, ASD's ACSC, the Canadian Centre for Cyber Security, Japan's NPA and NCO, NCSC-NZ, and Spain's CNI) can route the report. The advisory does not provide a STIX indicator file of its own, and the Australian Cyber Security Centre's parallel September 19, 2024 advisory remains the most detailed public reference for the older Mirai-variant botnet side of the activity [1][7][2].

The structural argument is the supply chain. The same week TP-Link faces a four-state lawsuit alleging the router giant hid its Chinese supply-chain ties, AA26-281A documents an actor that scans the entire internet for routers and IoT devices running old or unpatched software. A compromised home router sees everything the household touches; a compromised SOHO router in a small business sees the same. The tradecraft is not exotic, the broker market is [1].

What to Watch This Week

The first US-CISA advisory on the SoftEther VPN persistence. AA26-281A names SoftEther as the persistent-access tool and lists the renamed-binary masquerade as a tell. Watch for a STIX indicator package from CISA or a CISA-issued guidance memo for federal civilian agencies on detecting renamed SoftEther clients outside expected paths [1][5].

The first public naming of a US victim organization. AA26-281A names sectors and geographies, not individual organizations. Watch for the first breach disclosure under SEC's 2023 cybersecurity-incident rules that points to the tradecraft AA26-281A describes [1][2].

The second indictment against Integrity Technology Group personnel. The September 2024 announcement paired the botnet disruption with public attribution; the next step is individual criminal charges. Watch for a Department of Justice filing naming specific Integrity Technology Group employees [2][6].

The federal consumer-router response. The four-state TP-Link lawsuit landed October 7; AA26-281A lands October 8. Watch for the first FCC consumer-router rulemaking, and for the first CISA advisory specifically on consumer-grade router patching [1][2].

Australian, Japanese, and Spanish follow-on advisories. AA26-281A is signed by seven foreign agencies. Watch for each agency to publish its own country-specific advisory for local Flax Typhoon victims [1][7].

Sources

  1. CISA, FBI, NSA and international partners: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (AA26-281A, October 8, 2026). https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
  2. NSA, FBI, CNMF and partners: PRC-Linked Actors Compromise Routers and IoT Devices for Botnet Operations (joint Cybersecurity Advisory, September 18, 2024). https://media.defense.gov/2024/Sep/18/2003547016/-1/-1/0/CSA-PRC-LINKED-ACTORS-BOTNET.PDF
  3. FBI: FBI Director Announces Chinese Botnet Disruption, Exposes Flax Typhoon Hacker Group's True Identity at Aspen Cyber Summit (September 18, 2024). https://www.fbi.gov/news/stories/fbi-director-announces-chinese-botnet-disruption-exposes-flax-typhoon-hacker-group-s-true-identity-at-aspen-cyber-summit
  4. State of Surveillance: Volt Typhoon 2026 Tracker (2026). /articles/government/volt-typhoon-2026-tracker
  5. CISA: Defending Against China-Nexus Covert Networks (AA26-113A, April 23, 2026). https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-113a
  6. US Department of Justice: Court-Authorized Operation Disrupts Worldwide Botnet Used by People's Republic of China State (September 18, 2024). https://www.justice.gov/archives/opa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state
  7. Australian Cyber Security Centre: People's Republic of China-linked actors compromise routers and IoT devices for botnet operations (September 19, 2024). https://www.cyber.gov.au/advisory/peoples-republic-of-china-linked-actors-compromise-routers-and-iot-devices-for-botnet-operations