New Zealand’s National Cyber Security Centre (NCSC) has joined nine security and police agencies from six other countries in a detailed warning about Chinese government-linked hackers who, the agencies say, are supported by a China-based company called Integrity Technology Group.
The 58-page joint advisory, numbered AA26-281A, carries a publication date of 8 October 2026 and was posted on the NCSC’s alerts page on 9 October. Its co-authors are the FBI, the US Cybersecurity and Infrastructure Security Agency, the US National Security Agency, the United Kingdom’s National Cyber Security Centre, the Australian Signals Directorate’s Australian Cyber Security Centre, the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, New Zealand’s NCSC and Spain’s national intelligence centre.
The NCSC said it had “joined international partners in releasing an advisory concerning the activities of Chinese government-linked actors being enabled by a China-based company, Integrity Technology Group.” It pointed defenders to an extensive list of warning signs, known as indicators of compromise, in an appendix starting at page 19.
The advisory describes Integrity Tech as a China-based, for-profit company with links to the Chinese government. It says the company employs people who acquire or build hacking tools for use and sale, acquire and host infrastructure, and break into networks of victims around the world. The agencies say the activity is consistent with what security companies have publicly called Flax Typhoon, Ethereal Panda and Red Juliett, while noting that these hackers may also carry out work not associated with Integrity Tech. The information comes from evidence gathered during several FBI investigations, the document says.
On the same day, the US Justice Department announced court-authorised seizures of web domains linked to two hacking tools, called Microscan and FishHub. The department says that, as alleged in court documents unsealed in the Western District of Pennsylvania, people working for Integrity Tech operated and used the tools, and that the company has contracts with the Chinese government. It described the action as its second public disruption of the company’s hacking infrastructure, after it announced in September 2024 the court-authorised disruption of a botnet, a network of hijacked devices, made up of more than 200,000 consumer devices.
“The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity,” said Brett Leatherman, assistant director of the FBI’s Cyber Division, in the Justice Department release.
This is not the first time New Zealand has joined a warning about the same company. On 19 September 2024 the NCSC joined partners in an advisory about a botnet built from compromised home and small office routers, firewalls, storage drives and internet-connected gadgets. That advisory identified Integrity Technology Group as the organisation controlling and managing the botnet, which it said had been active since mid-2021. In April 2026 the NCSC also published guidance on defending against covert networks of compromised devices, which it said are believed to be used by most China-linked hackers.
The new advisory goes further into how the hackers work once they find a target. They start with scanning, using freely available tools to look for weaknesses in networks and websites. “The use of open source tools typically found on GitHub suggests the threat actors tend to look for more vulnerable targets,” the advisory says. Since as early as 2017, it says, they have also used Microscan, a web application containing more than 1,300 testing scripts aimed at specific weaknesses in software including WordPress, Jenkins, Apache Struts and Oracle WebLogic.
To get in, the agencies say the hackers use cross-site scripting, a technique that slips malicious code into a vulnerable web page so it runs in a visitor’s browser. The FBI recovered one such payload that changed a page to show username and password boxes, collecting whatever people typed. The hackers also use an open source tool called EBurst for password spraying, which means trying common passwords across many email accounts, against Microsoft Exchange and Office 365 systems.
Once inside, they install SoftEther, a legitimate virtual private network (VPN) program, and often rename the installer to look like ordinary Windows files. The advisory notes that “endpoint detection software is less likely to flag SoftEther because it is a legitimate VPN software.” Other tools described include a script that pulls email through Microsoft’s Exchange Web Services and a program that copies account details from a Windows network’s central user directory.
According to the advisory, the FBI recovered an archived email database used to target victim organisations. Victims of email theft included government organisations, law enforcement agencies, healthcare systems and religious institutions in Southeast Asia, and in some cases access to the stolen data was restricted to internet addresses in Xiamen, China. The agencies also say the hackers run a web application that gives third parties access to stolen email. The advisory does not name any New Zealand victim.
One detail matters for New Zealand businesses and agencies. The advisory’s appendix lists eight software weaknesses the hackers successfully exploited, and none is new. They date from 2014 to 2023 and affect older versions of the Bash command shell, the ProFTPD file transfer server, the BIND domain name server, Apache Struts, Pulse Secure’s Pulse Connect Secure remote access gateway, GitLab, ONLYOFFICE Document Server and the Strapi content system. Five are marked as newly added to the US government’s list of known exploited vulnerabilities. In Newswire’s reading, the lesson is that in these cases the way in was old, unpatched software and weak passwords rather than anything exotic, a point Newswire also made last week about how fast WordPress sites now need patching.
The authoring agencies’ key recommended actions are to turn off unused services and ports such as remote access and file sharing, to clean user input in web applications so cross-site scripting code cannot be injected, and to require multifactor authentication, particularly for webmail, VPNs and accounts that reach critical systems. The fuller list includes applying patches promptly, replacing software that is no longer supported, replacing default passwords, and watching for unexpected copying of the user directory or unusually large uploads from computers that normally send little data. The agencies ask organisations that find signs of the activity to isolate affected machines, investigate how far the intrusion has spread and report it.
Newswire could not find a public response from Integrity Technology Group to the advisory or the domain seizures. The Justice Department’s claims about the company are set out as allegations in court documents.
New Zealand organisations can report a cyber security incident through ncsc.govt.nz or by calling 0800 114 115, which the NCSC says is free within New Zealand and open from 7am to 7pm, Monday to Friday.
Does your organisation still run old servers or email systems that are hard to keep patched? Tell us in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply