ASD Co-Signs Global Alert on Chinese Hacking Firm — Check Your Exposed Services Now

Australia's own cyber agency has co-signed an international advisory warning that a Chinese state-linked group is actively exploiting five known vulnerabilities — several of them over a decade old — against organisations worldwide. If your environment has unpatched internet-facing software, it's time to check right now.

On 8 October 2026, the FBI and US Department of Justice seized seven domains belonging to Integrity Technology Group, a Beijing-based contractor linked to the China-backed threat group tracked as Flax Typhoon (also known as Ethereal Panda and Red Juliett). The seized infrastructure includes MicroScan, a commercial vulnerability scanner used to identify and exploit exposed services, and FishHub, a spear-phishing platform. A joint advisory — AA26-281A — was published the same day by agencies across seven countries: the US, UK, Canada, Japan, New Zealand, Spain, and Australia.

Australia's ASD explicitly stated that the vulnerabilities, tactics, and procedures described in the advisory apply to Australian entities. The group's tools are indiscriminate — MicroScan runs automated scans against internet-facing services, so geography is no protection. Confirmed targets in the campaign include government offices, critical manufacturing, healthcare, law enforcement, and education institutions across Southeast Asia and North America.

The Five CVEs Now on CISA's KEV List

These are old vulnerabilities. That's the uncomfortable part — they're being exploited in 2026 precisely because they're still running in environments where "if it ain't broke, don't fix it" became a security strategy.

What to Do Now

Most Australian businesses won't be running ProFTPD or ISC BIND front-of-house — but these services frequently live on forgotten internal servers, legacy hosting environments, or old VMs that "just keep running." That's exactly the attack surface this group is scanning for.

• Patch or decommission the five affected products. If ProFTPD, ONLYOFFICE, Apache Struts 2.x, Strapi, or ISC BIND is running in your environment — especially internet-facing — update immediately or take it offline until you can.
• Enable phishing-resistant MFA. The group uses password spraying against Microsoft Exchange and VPN portals. MFA stops credential stuffing cold. If you're still on SMS-based MFA, upgrade to an authenticator app or hardware key.
• Hunt for SoftEther VPN on Windows hosts. This group uses SoftEther as a persistence mechanism after initial access. Check running processes and installed software for it.
• Review Exchange logs for password-spray patterns. Look for a high volume of failed logins from a single IP, then a successful login shortly after. Rotate credentials for any accounts that were hit.
• Replace end-of-life software. If a server hasn't had a vendor patch in years, it shouldn't be internet-facing. Audit your exposed services — most businesses find two or three forgotten ones when they look properly.

Written by Michael Sacco, Technical Lead, All IT Services. All IT is a Sydney-based managed IT provider supporting businesses across Australia, including the Northern Beaches, Central West NSW, Brisbane, and Melbourne.