China-Linked Hacker Advisory: What an NC Plant Should Check

TL;DR: On October 8, 2026, ten agencies in seven countries warned about Chinese government-linked hackers enabled by a China-based company, Integrity Technology Group. The advisory calls their methods consistent with the activity publicly known as Flax Typhoon. Critical Manufacturing is one of the four U.S. sectors the advisory names as targeted. The same day CISA added five flaws to its exploited list, published between 2015 and 2023. For a North Carolina plant the useful question is what of yours answers on the internet, and how old that software is.

What did the October 8 advisory actually say?

It says the group gets in the cheap way. Advisory AA26-281A, co-authored by the FBI, CISA and NSA with partners in the UK, Australia, Canada, Japan, New Zealand and Spain, describes automated scanning, large botnets, cross-site scripting, and password spraying against Microsoft Exchange and Office 365 mailboxes, followed by VPN software installed for persistence and scripts that pull out email and credentials.

The targeted sectors it lists are Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology, plus U.S. law enforcement, education and religious organizations. CISA tags it for "Small and Medium Businesses." The Justice Department announced the same day that it had seized domains behind two tools, Microscan and FishHub, that court documents allege Integrity Tech's actors operated. According to court documents it cites, the targets of Microscan scanning included "a U.S. power company based in South Carolina."

One sentence in the advisory matters more than the rest to a plant with one IT person, or none: "The use of open source tools typically found on GitHub suggests the threat actors tend to look for more vulnerable targets." Read it as an owner. If they tend to go after easier targets, how easy you are to break into matters as much as who you are.

Which flaws are they using, and how old are they?

Eight, and most of them you will never run. In our judgment the two a shop your size is likeliest to have are an FTP server, the kind set up so customers can send drawings, and an older remote-access VPN. Ask about those two first. The full list is for whoever runs your IT.

All eight are in CISA's Known Exploited Vulnerabilities catalog as of October 8; five went in that day. Publication dates are from each CVE record:

None of these is new. Every one has been public for at least three years. CISA's catalog entry for the Strapi flaw goes further: it warns the affected product "could be end-of-life" and advises users to discontinue use or move to a supported version.

So a plant manager in Greensboro or Hickory can set aside the idea of an unstoppable zero-day. What this advisory describes is software that should have been updated or switched off years ago and still answers when somebody knocks.

Key takeaway: The flaws in AA26-281A were published between 2014 and 2023. If one of them is on your network, it was public knowledge long before the attacker arrived. The work is finding the box.

Does a Chinese espionage advisory really apply to a small NC manufacturer?

Yes, for a mechanical reason. The advisory says that in general the group focuses its scanning on six ports: 21 for FTP, 22 for SSH, 53 for DNS, 80 and 443 for web traffic, and 1080 for SOCKS proxies. A scanner sweeping those ports cannot tell a defense prime in Raleigh from a cabinet shop in Thomasville.

Most coverage will file this under nation-state espionage and move on, and that is the wrong read for a company your size. The large targets in critical infrastructure are the ones most likely to have a security team reading the indicator list. The plant with a file transfer box a vendor set up years ago does not, and that box is exactly what the advisory describes being swept for.

What does port 21 look like in a factory? Often something somebody asked for and nobody retired: an FTP site so a customer could send drawings, or a drop folder for an EDI partner. Neither is wrong in itself. The trouble starts when it runs the software it was installed with and nobody on staff knows it faces the internet.

If you cannot say today which of your systems answer from the internet, start there. Preferred Data Corporation has worked with North Carolina companies from High Point since 1987, and an external exposure review is where we begin. Call (336) 886-3282.

Why does the advisory spend so much space on email passwords?

Because password spraying gets into mail that is otherwise patched. The advisory says the group uses an open-source tool, EBurst, against accounts in the Office 365 cloud and on Exchange servers, trying passwords against each supplied address. It lists ten Exchange interfaces the tool can use, including Outlook on the web, ActiveSync (the phone mail app), Exchange Web Services, Autodiscover and PowerShell, and tells defenders to cover all of them, the login page being only one.

Separately, the FBI observed a script built to pull email, calendars and contacts through Exchange Web Services. In a manufacturer that mailbox holds quotes, drawings, customer pricing and the invoices someone could later spoof.

So:

• Moving to Microsoft 365 did not remove this risk. The advisory names the Office 365 cloud environment directly. What protects a cloud mailbox is MFA on every person's account, with the older sign-in methods that skip MFA switched off.
• On-premises Exchange is the harder case. Microsoft's lifecycle page lists Exchange Server 2019's extended support as having ended October 14, 2025. If one still runs in your building, read our Exchange end-of-support playbook: this advisory is one more reason not to let that server be the last one standing.

The advisory asks for MFA "for all services (to the extent possible), particularly for webmail, VPNs, and accounts that access critical systems." Those four words in brackets are where the holes are. In a plant the gaps tend to be a shared shipping mailbox, a scanner that emails PDFs, or the account an ERP uses to send invoices, and a spraying tool finds exactly those. Those are not people, so MFA is the wrong fix for them. Microsoft's guidance on shared mailboxes is to "Always block sign-in for the shared mailbox account and keep it blocked," with the people who use it reaching it through their own MFA-protected logins. A scanner or ERP that signs in with a username and password needs to move to a sending method that does not depend on a password at all, which is a configuration job. Turning old sign-in methods off can break exactly those devices, so ask for the list before anything changes and fix each one rather than leaving it open.

What is SoftEther, and why should an owner care about one program name?

SoftEther is legitimate VPN software, and the advisory notes that its legitimacy makes endpoint detection less likely to flag it. After getting in, they install the SoftEther client, set it to reconnect on startup, and often name the installer conhost.exe or dllhost.exe so it looks like part of Windows. In the advisory's words, "endpoint detection software is less likely to flag SoftEther because it is a legitimate VPN software."

Antivirus looks for bad software. A VPN client nobody approved is a door somebody else installed. You do not need to understand the answer to this one, only to get a yes or no in writing: is SoftEther, or any VPN client we did not install on purpose, on any of our computers? If your provider has a management agent on every machine, it is a search. If there is no inventory to search, that gap is the finding.

What should a North Carolina plant do now?

CISA gave federal agencies until October 11, 2026 to deal with the five new flaws. That date has passed, and it never bound a private company, but if one of the five still answers on your network, treat it as overdue. Work from the outside in.

1. Get a list of everything that answers from the internet. The advisory itself suggests "an attack surface management service or web-based search platforms that search the internet to identify exposed services or ports." There is a no-cost option worth an email: CISA's Cyber Hygiene vulnerability scanning checks internet-facing static addresses and sends weekly reports, and is open to "public and private sector critical infrastructure organizations." Whether a given manufacturer qualifies is CISA's call.
2. Put a date next to every item. Version, last update, and whether the vendor still supports it. The advisory's line is blunt: "Replace end-of-life products with supported alternatives that are included in vendor support plans."
3. Find out who uses it, then switch off what nobody can justify. The advisory says to "Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols." Before you pull anything, ask who depends on it: the customer who sends drawings, the EDI partner, the machine builder's remote-support link on a press brake. Blocking it at the firewall is reversible; deleting it is not.
4. Close the email gaps. MFA on every person's account, sign-in blocked on every shared mailbox, and a written list of each scanner, copier or program that still signs in with a password and when it will be moved off.
5. Get the SoftEther yes or no.
6. Name an owner for each exposed system. If a vendor installed it, someone on your side still has to be answerable for it. That is most of what managed IT is for.

If you would rather forward this than read it twice, here is the email:

Can you send me, within five business days: (1) a dated list of every address, port and piece of software we expose to the internet, with the version and whether it is still supported; (2) every person without MFA, every shared mailbox that can still be signed into directly, and every device or program that sends mail with a password; (3) a yes or no on whether SoftEther or any VPN client we did not approve is on our machines; (4) who owns each item on list 1.

What a good answer looks like is paper, not reassurance: a list with a date on every line, inside a week. For a manufacturer in the Piedmont Triad, a break-in can cost more than the stolen files: investigating how far an intruder got can mean downtime on top of the theft.

We can run those steps for you, including the conversation with whoever installed the box. Call (336) 886-3282 or request a review. We come on-site anywhere within 200 miles of High Point and work with clients remotely across the US and around the world.

Have we heard this name before?

Yes. In September 2024 the Justice Department disrupted a botnet it attributes to Integrity Tech of "more than 200,000 consumer devices," and the U.S. Attorney for the Western District of Pennsylvania called the October 2026 seizures the "second disruption of Integrity Tech's massive operations in as many years." Help Net Security counts seven domains seized, and The Hacker News quotes CISA's Chris Butera saying Chinese government-affiliated actors "continue to position themselves within critical infrastructure networks." Our May post on China-linked actors compromising small business routers covers the edge-device side of this kind of activity.

A seized domain changes nothing on your network. Send the email above today. If the reply is a question instead of a list, call us.

Frequently Asked Questions

What is Flax Typhoon?

A name used publicly for a China-linked hacking group. Advisory AA26-281A, published October 8, 2026, says hackers enabled by Integrity Technology Group, a China-based company that the Justice Department says has contracts with the Chinese government, use methods consistent with Flax Typhoon's, and the Justice Department links its seizures to "the Flax Typhoon threats." The advisory describes the methods: scanning, password spraying, cross-site scripting and VPN software for persistence.

Did we have to patch by October 11?

No. That date, October 11, 2026, applied to U.S. federal civilian agencies, not private companies, and it has now passed. If any of the five flaws CISA added on October 8 is still on your network, treat it as overdue: CISA lists all five as exploited, and every one has been public for at least three years.

We moved our email to Microsoft 365. Are we covered?

Not automatically. The advisory says the spraying tool targets accounts in the Office 365 cloud. What protects you is MFA on every person's account, direct sign-in blocked on shared mailboxes, and older sign-in methods turned off once each scanner or program that depends on them has been moved.

How do I find out what we have exposed to the internet?

Ask your IT provider for an external scan, delivered as a dated list of addresses, open ports and the software behind each one. The advisory recommends an attack surface management service or internet search platforms, and CISA runs a no-cost scanning service for eligible critical infrastructure organizations. If nobody can produce the list within a week, that is your first finding.

Does an old FTP server really matter if nothing sensitive is on it?

It can. The ProFTPD flaw added on October 8 lets an attacker read and write files remotely, and a server that accepts writes from outside is a foothold whatever it was meant to hold. If customers still send files that way, move them to a supported transfer service, tell them the date, and then shut the old one down.

Related Resources

• Managed Cybersecurity for NC Businesses - External exposure reviews and MFA coverage
• Managed IT Services - Patching, inventory and a named owner for every system
• Network Infrastructure - Firewalls, remote access and what faces the internet
• On-prem Exchange 2016 and 2019: the end-of-support playbook
• China-linked router and IoT compromise: CISA's April 2026 warning
• What IT downtime costs an NC manufacturer
• Contact Preferred Data Corporation - High Point, NC. (336) 886-3282