CISA: Integrity Tech password spraying and DCSync (AA26-281A)

CISA, the FBI, the NSA and international partners have published advisory AA26-281A on threat actors working through Integrity Technology Group, a China-based company with links to the Chinese government. The tradecraft is mostly identity work: password spraying against Exchange, fake login prompts and DCSync to copy Active Directory credentials.

What happened

The advisory, released October 8, 2026, is co-sealed by the FBI, CISA, NSA, the UK NCSC, Australia's ASD's ACSC, the Canadian Centre for Cyber Security, Japan's NPA and NCO, New Zealand's NCSC and Spain's CNI. It covers activity attributed to actors enabled by Integrity Technology Group, tracked publicly as Flax Typhoon, Ethereal Panda and Red Juliett. According to the advisory, they have had access to victim networks since at least mid-January 2021.

U.S. victims span government services, critical manufacturing, healthcare and IT, plus law enforcement, education and religious organizations. Victims outside the U.S. are in Southeast Asia, Africa and North America.

The agencies describe a mix of automated tools and hands-on work:

• Exchange password attacks: EBurst, an open-source Python tool, runs password spraying and guessing against Exchange interfaces including OWA, EWS, ECP, OAB, Autodiscover, MAPI, RPC and PowerShell. Mail was later pulled out through the EWS API.
• Credential harvesting by XSS: injected payloads changed web pages to show username and password fields, then offered a password-protected .zip holding a malicious executable.
• DCSync: a tool named DC.exe used directory replication over RPC against domain controllers to copy account credentials, group membership and trust relationships. Secretsdump is also listed.
• Persistence: SoftEther VPN installers renamed conhost.exe or dllhost.exe to look like Windows binaries, along with web shells and living-off-the-land techniques.

The table of successfully exploited CVEs is mostly old edge and web software: GNU Bash (CVE-2014-6278), ProFTPD 1.3.5 (CVE-2015-3306), ISC BIND 9.x (CVE-2015-5477), Apache Struts 2.3.19–2.3.28 (CVE-2016-3081), Pulse Connect Secure 8.2–9.0 (CVE-2019-11510), GitLab 11.9+ (CVE-2021-22205), ONLYOFFICE DocumentServer 5.1.5–5.6.2 (CVE-2021-3199) and Strapi up to 4.5.5 (CVE-2023-22894). CISA has published STIX indicators alongside the PDF.

Why it matters

Nothing here needs a zero-day. The way in is unpatched internet-facing software that has had fixes for years, plus passwords on the main mail platform. Once inside, DCSync turns one privileged foothold into the whole directory: every hash, every group, every trust. At that point the incident is about the identity plane, and password resets alone won't contain it.

Exchange is the pivot in both directions. It is the spraying target, and through EWS it is also the way mail leaves. On-premises Exchange with legacy protocols and no MFA in front is exactly the setup EBurst is built to work against.

Monitor for signs of unauthorized use of LOTL tools and unexpected Active Directory replication. — AA26-281A

What to check in your environment

• Sweep for the listed CVEs. Check external attack surface and asset inventory for the eight products and version ranges above. The advisory says to apply patches and updates, including software and firmware, and to replace end-of-life products. In our view, an exposed Pulse Connect Secure 9.0 or ProFTPD 1.3.5 should be retired, not just patched.
• Find who can replicate directory changes. List every account and group holding AD replication rights outside the domain controllers themselves, remove what isn't needed, and alert on replication requests coming from hosts that aren't DCs.
• Review Exchange sign-in failures. Look for many accounts failing from the same sources across OWA, EWS, Autodiscover and the other endpoints EBurst targets, and for logons outside normal working hours, which the advisory calls out.
• Require MFA on every exposed service. The advisory says MFA for all services to the extent possible. Prioritize Exchange web endpoints and VPNs, and check which legacy protocols still accept a password alone.
• Replace default passwords on appliances, admin consoles and service accounts, per the advisory.
• Hunt the host artifacts. Search for conhost.exe or dllhost.exe outside their normal Windows paths, SoftEther VPN installs, and the web shell names the advisory lists (for example b374.php and file_back.aspx). Load the STIX indicators into your detection tooling.
• Treat a DCSync hit as full directory compromise. Plan for resetting privileged and service account credentials and reviewing trusts, not just the first compromised user.

References

• CISA AA26-281A: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data