Cyber Agencies Warn China-Linked Hackers Are Pairing Automated Scanning With Hands-On Break-Ins

The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) has joined partners in the United States, United Kingdom, Canada, Japan, New Zealand and Spain in a joint advisory published on 9 October 2026. It describes how Chinese government-linked threat actors break into networks, keep access over time and extract sensitive data. The advisory names China-based Integrity Technology Group (Integrity Tech) as a company with links to the Chinese government that provides infrastructure, tools and services supporting malicious cyber operations.

According to the advisory, the findings draw on technical evidence from multiple FBI investigations. They describe an extensive espionage ecosystem that pairs automated vulnerability discovery with hands-on exploitation and data theft. A central finding is the use of large-scale botnets, virtual private network infrastructure, legitimate system utilities and specialised exploitation tools to find vulnerable networks. Targets have included government agencies, critical manufacturing, healthcare, information technology, law enforcement, educational institutions and religious organisations, with victims identified across the United States, Southeast Asia, Africa and North America.

The tactics are consistent with groups publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett. Authorities caution, however, that the activity of these groups does not necessarily correspond directly with Integrity Tech's operations. This summary is based on the opening of the source article, so further technical detail and recommendations may appear in the full advisory.