The newest of the five holes is numbered from 2023. The oldest, from 2015. The actors in the advisory get in through old holes and go after devices that organizations do not monitor closely.
Fact
The facts: on 8 October 2026 CISA, FBI and NSA, together with the UK's NCSC, Australia's ACSC, Canada's Cyber Centre, Japan's NPA and NCO, New Zealand's NCSC and Spain's CNI, published advisory AA26-281A about Integrity Technology Group, a China-based cybersecurity company with ties to the Chinese government. Per the advisory, the company supplies tools, infrastructure (botnets and VPN) and intrusions to threat actors whose techniques CISA calls consistent with the publicly known Flax Typhoon, Ethereal Panda and Red Juliett; the advisory also notes that these actors may perform activity not associated with Integrity Tech. The targets are edge devices that organizations do not monitor closely. In the US the targets are in government, critical manufacturing, healthcare and information technology, as well as law enforcement, education and religious organizations, plus organizations across Southeast Asia, Africa and North America. The techniques are scanning, XSS, password spraying against Microsoft Exchange, SoftEther VPN for persistent access and exfiltration of email. The advisory lists eight vulnerabilities, and the same day CISA added five of them to its Known Exploited Vulnerabilities (KEV) catalog: ISC BIND (CVE-2015-5477, denial of service), ProFTPD, Apache Struts (CVE-2016-3081, command execution), ONLYOFFICE Docs and Strapi (CVE-2023-22894; CISA notes the product may be end-of-life). The deadline for all five is 11 October 2026 under directive BOD 26-04; for four of them (all but BIND) the catalog, under the same directive, also requires a forensic triage to check whether the system is already compromised. CISA marks their use in ransomware campaigns as unknown.
Who does the advisory describe? A company, not a group. According to CISA and the FBI, Integrity Tech acquires or develops tools, hosts infrastructure and breaches networks for others. The link to Flax Typhoon is in consistent techniques, and the advisory itself notes that these actors may also act outside Integrity Tech. So do not put an equals sign between the two names.
The most concrete part of the advisory is how they get in and how they stay. Exchange mail, which the actors guess at with password spraying. SoftEther, a real VPN program whose installers they name conhost.exe or dllhost.exe so it looks familiar. Endpoint protection is less likely to flag it, because the program is legitimate.
The same day, 8 October, the US Department of Justice (DOJ) and the FBI announced court-authorized seizures that cut off access to two Integrity Tech hacking tools. According to the court documents cited by the DOJ, "Microscan" searches victim networks for vulnerabilities that the company's clients would later exploit, and the scanning also runs through a botnet of internet-of-things devices infected with a variant of Mirai. Among its targets the DOJ lists a power company in South Carolina, airports in Japan and Poland, and Taiwanese critical infrastructure companies in the natural gas and power sectors. "FishHub" gets in through spear phishing, then downloads more malware into the network, for remote access or to search for files it sends to servers controlled by the company. Its confirmed victims include approximately 20 Taiwanese universities.
Among the seized domains, the DOJ names c0cc[.]cc, through which the company accessed Microscan, and five that helped deliver the FishHub malware: 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net. Look for them in your DNS logs. According to the DOJ, this is its second public technical disruption of Integrity Tech's hacking infrastructure. The first was in September 2024, when the DOJ announced the court-authorized disruption of the company's Mirai botnet, with more than 200,000 consumer devices in the United States and worldwide.
A hole is old only for the one who has patched it.
The deadline is 11 October, a Sunday, three days after the announcement. It applies to US federal civilian agencies under directive BOD 26-04; for everyone else it is a signal, not an obligation.
If you run BIND, ProFTPD, Struts, ONLYOFFICE Docs or Strapi, check the versions today and look for traces of a breach that has already happened: the advisory asks for both. For Strapi, CISA adds in the catalog that the product may be unsupported and advises you to stop using it or move to a supported version. If you have none of the five, the advisory starts with the simplest thing: turn off the services and ports you do not use.
Sources
CISA - press release on Integrity Technology Group, 08.10.2026CISA - advisory AA26-281A, 08.10.2026CISA KEV (CVE-2015-5477, CVE-2016-3081, CVE-2023-22894), 08.10.2026CISA - BOD 26-04: Prioritizing Security Updates Based on Risk, 10.06.2026US Department of Justice (DOJ) - press release 26-1155 on the seizure of Microscan and FishHub, 08.10.2026The visual is generated code-art, no third-party images.