A Chinese state hacking group is still exploiting decade-old CVEs

CISA, the FBI, NSA and international partners published a joint advisory on 8 October naming Integrity Technology Group, a China-based company, as the enabler behind threat actors tracked as Flax Typhoon, Ethereal Panda and Red Juliett. The group pairs mass automated scanning with hands-on-keyboard follow-up against government, healthcare, manufacturing and IT organisations in the US, Southeast Asia, Africa and North America.

The advisory lists eight CVEs the group relies on, all now added to CISA’s Known Exploited Vulnerabilities catalogue: bugs in GNU Bash (2014), ProFTPD and BIND (2015), Apache Struts (2016), Pulse Secure (2019), GitLab (2021), ONLYOFFICE (2021) and Strapi (2023). Attackers scan the open internet with Nmap, Masscan and dirsearch to find instances still unpatched for these, then move in with XSS credential harvesting, password spraying against Microsoft Exchange, SoftEther for VPN persistence and DCSync to pull credentials from Active Directory.

Why it matters: every one of these bugs has had a patch for years, some for over a decade. If you’re running self-hosted GitLab, BIND, Struts or ProFTPD and haven’t checked their patch levels recently, this advisory is the reminder that state-linked actors are still scanning for exactly that gap. All eight are now on the KEV list, which puts a mandated remediation clock on US federal systems and is a reasonable deadline for anyone else to copy.

The caveat: CISA doesn’t give a victim count or name specific organisations, so the advisory describes exposure by sector rather than with hard numbers.