Chinese Government-Linked Actors Steal Sensitive Data, CISA Warns

The US Cybersecurity and Infrastructure Security Agency (CISA) has published a joint cybersecurity advisory (AA26-281A) detailing cyber activities attributed to Chinese government-linked threat actors. These actors, associated with groups such as Integrity Tech and tracked under names like Flax Typhoon, employ a combination of automated reconnaissance and hands-on intrusion to exfiltrate sensitive data.

According to the CISA report, Integrity Tech supports these operations by developing or acquiring tools, hosting infrastructure, and compromising networks. Targets have included US critical infrastructure and organizations across Southeast Asia, Africa, and North America. The described tactics involve exploiting web vulnerabilities, deploying malware, and establishing persistent, stealthy remote access.

The threat actors utilize extensive botnets, VPNs, and a collection of hacking tools. They combine tools already present on victim systems and legitimate remote access software with custom-built tools for data collection. Notably, they exploit cross-site scripting (XSS) vulnerabilities on web pages and deploy malware like DiagTrack.exe for data theft, while using SoftEther VPN clients to ensure persistence within compromised systems. Picus Security, a cybersecurity firm, has released an analysis of these attack techniques. The company offers its platform to simulate Flax Typhoon threats, allowing organizations to validate their security controls against such sophisticated attacks.