ASD and Five Eyes Warn of China-Linked Intrusions Through Exchange and Microsoft 365

On 9 October 2026 the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) joined the US FBI, CISA and NSA, the UK National Cyber Security Centre, and partner agencies in Canada, Japan, New Zealand and Spain to publish a joint advisory on China-linked cyber operations.

The advisory describes a China-based company, Integrity Technology Group, which it says has links to the Chinese government and supplies infrastructure, tools and services for malicious cyber operations. It references activity tracked as Flax Typhoon, Ethereal Panda and Red Juliett, while cautioning that those groups do not necessarily correspond directly to the company's operations.

The advisory does not publicly name Australian victims. The victims it identifies are in the United States, Southeast Asia and Africa, and the agencies say it is particularly relevant to Australian government, critical infrastructure and wider Indo-Pacific organisations. What makes it worth reading is how ordinary the techniques are.

How the Intrusions Work

According to the advisory, the actors blend automated scanning with hands-on activity:

• Automated reconnaissance. Public tools such as Nmap, masscan and dirsearch, plus a Python tool called MicroScan with more than 1,300 penetration-testing scripts, are used to find vulnerable internet-facing systems.
• Credential attacks. Password spraying and credential guessing against Microsoft Exchange and Microsoft 365 using a tool called EBurst, and malicious cross-site scripting that displays fake login fields.
• Living off the land. Legitimate administration tools are abused so activity blends in.
• Quiet persistence. SoftEther VPN is configured to reconnect automatically. Because it is legitimate software, it can slip past endpoint alerts.
• Data theft. Scripts use Exchange Web Services to pull email, calendars and contacts. The stolen data is compressed or encrypted and sent out under file names that resemble website resources.

The sectors listed include government, critical manufacturing, healthcare, information technology, law enforcement, education and religious organisations. It also follows a September advisory on China-linked actors using compromised routers and internet-connected devices, which noted that blocking known malicious IP addresses works poorly when attackers can change infrastructure quickly.

Why It Matters to Mid-Sized Australian Organisations

Nothing here needs a zero-day. The entry points are an exposed service, a weak or reused password, and a mailbox nobody is watching. Those are the same gaps we find in penetration tests and in Essential Eight gap assessments. The advisory is a useful reminder that state-linked actors use the same basics as everyone else, and they are patient.

If you hold sensitive client email, tender material or operational data in Exchange or Microsoft 365, you are the kind of target the advisory describes.

What to Check This Week

The agencies recommend reviewing the published indicators of compromise, enforcing multi-factor authentication, patching internet-facing systems, and monitoring privileged accounts. Translated into tasks:

1. Check for password spraying. Review sign-in logs for many failed attempts across many accounts from the same sources, and for successful sign-ins that follow a run of failures.
2. Enforce phishing-resistant MFA on all accounts, with priority on administrators and executives. Disable legacy authentication that bypasses it.
3. Inventory what is exposed to the internet. If an on-premises Exchange server, a VPN gateway or an old portal is reachable and unpatched, fix that first.
4. Look for unexpected remote access tooling. Search endpoints and servers for VPN clients nobody installed on purpose, including SoftEther.
5. Review mailbox access. Look for unusual Exchange Web Services activity and large or unexplained data transfers.
6. Audit cloud apps with access to mail and files. Remove OAuth grants and integrations you cannot account for.
7. Review Active Directory replication and privileged accounts, as the advisory recommends.
8. Test your detection. Run the advisory's techniques against your own environment and confirm your logging would notice them.

If you suspect compromise, the agencies advise isolating affected systems, preserving forensic evidence, determining the extent of access and coordinating removal of the actors, rather than cleaning up piecemeal. Under the Cyber Security Act 2024, entities above the turnover threshold that make a ransomware or cyber-extortion payment also have reporting duties to ASD.

Where We Fit

Our VAPT service can test your external attack surface and Microsoft 365 configuration against the behaviours in this advisory, with findings scored and mapped to the controls you need. If you want a second pair of eyes before the next tender or insurance renewal, get in touch.

Sources

• Cyber agencies warn of China-linked hackers blending automated scanning with hands-on intrusions, Australian Cyber Security Magazine
• Australian Cyber Security Centre, cyber.gov.au

This article summarises the public advisory as reported on 12 October 2026. Read the primary advisory on cyber.gov.au for the full indicators of compromise.