Seven Nations Just Named the Chinese Company They Say Is Behind Years of Cyber Intrusions

On October 8, the U.S. Cybersecurity and Infrastructure Security Agency added five vulnerabilities to its Known Exploited Vulnerabilities catalog and gave federal agencies an unusually tight deadline: patch or disconnect the affected systems by October 11. Three days. That deadline just passed, and the reason for the urgency is worth understanding, because it has nothing to do with a shiny new zero-day.

The five vulnerabilities, disclosed between 2015 and 2021, are being actively exploited by a China-linked espionage actor known as Flax Typhoon. The same week, seven nations, Australia, Canada, Japan, New Zealand, Spain, the United Kingdom, and the United States, issued a joint advisory warning that the attacks were enabled by cyber actors associated with Integrity Technology Group, a China-based cybersecurity company. A state-linked campaign, running on decade-old bugs, exposed by a seven-country coalition. There is a lot to unpack here.

The five vulnerabilities, and how old they are

Here is the full list CISA flagged, with the details reported by The Hacker News. CVE-2015-3306 is an improper access control flaw in ProFTPD carrying the maximum CVSS score of 10.0, letting remote attackers read and write arbitrary files through the server's site cpfr and site cpto commands. CVE-2021-3199 is a path traversal bug in ONLYOFFICE Docs scored 9.8, triggered by a "/.." sequence in an image upload parameter when JSON Web Tokens are in use, with potential for remote code execution. CVE-2023-22894 is a cleartext storage of sensitive information flaw in Strapi scored 7.2, which can let someone with admin panel access discover user details through the query filter. CVE-2016-3081 is a command injection vulnerability in Apache Struts scored 8.1, exploitable via the method: prefix when Dynamic Method Invocation is enabled. CVE-2015-5477 is a reachable assertion flaw in ISC BIND scored 7.5, allowing a remote attacker to cause a denial-of-service through TKEY queries.

Four of the five are from 2015 to 2021. The patches have existed for years. Every one of these products, ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, ISC BIND, is open-source software widely deployed across global server infrastructure. That combination, old known flaws plus ubiquitous deployment, is exactly what makes the campaign work. An attacker does not need to burn a valuable zero-day when the front doors were left open a decade ago and nobody closed them.

What Flax Typhoon is actually doing

Flax Typhoon is a China-linked threat actor that CISA says is using these flaws to gain initial access to organizations and siphon sensitive data. According to the joint advisory, the campaign uses a familiar but effective toolkit: scanning tools to find vulnerable systems, cross-site scripting attacks, and password spraying against Microsoft Exchange servers to brute-force credentials. Once inside, the actors set up persistence through VPN software and exfiltrate emails and credentials using scripts.

The targeting is what alarmed the agencies. The operations are aimed at eight vulnerabilities in total, including the five newly listed, and they are reaching into critical infrastructure networks. CISA's Acting Executive Assistant Director for Cybersecurity, Chris Butera, put it directly: "Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing." That framing matters. This is not described as smash-and-grab data theft. It is described as pre-positioning, getting quietly embedded in industrial and utility networks now, in case disruption is wanted later.

Four of the five vulnerabilities were disclosed between 2015 and 2021. The patches existed for years. The attackers came anyway.

Seven nations, one attribution

The joint advisory is a story in itself. Public, multi-country attribution is one of the strongest signals intelligence agencies can send without revealing sources and methods. When seven nations put their names on a document pointing at actors associated with a specific Chinese cybersecurity company, it means the evidence was convincing enough to spend real diplomatic capital on. Integrity Technology Group has not, in the reporting reviewed for this article, publicly responded to the allegation.

The advisory also widened the picture. The campaign targets eight vulnerabilities, not just the five CISA listed last week. The other three already sit in the KEV catalog: CVE-2014-6278, the Shellshock command injection bug in GNU Bash, added to the catalog in October 2025; CVE-2019-11510, an arbitrary file read in Ivanti Pulse Connect Secure, listed since November 2021; and CVE-2021-22205, a remote code execution flaw in GitLab Community and Enterprise Editions, also listed since November 2021. Read that list again and notice the pattern. Every single one is old. Every single one is patched. Every single one is still working for the attackers.

There is one more detail in the fine print that defenders should notice. Under Binding Operational Directive 26-04, CISA required federal agencies to perform forensic triage for four of the five newly listed vulnerabilities, every one except the ISC BIND flaw. In plain terms: do not just patch. Check whether you were already compromised before you patched. That requirement exists because these vulnerabilities were being exploited in the wild before the deadline, which means the exploitation window opened before the patch was ever installed. If an attacker got in during that window, a patch does not evict them.

What the rest of us should take from this

The federal deadline of October 11 applied to U.S. federal civilian agencies, but the vulnerabilities do not care about your sector. The same ProFTPD servers, ONLYOFFICE Docs instances, Strapi deployments, Struts applications, and BIND servers exist in private companies, universities, and local governments across the world, and many of them are just as unpatched. A three-day federal deadline is CISA's way of saying this is not a routine backlog item. When the agency gives 72 hours instead of the usual weeks, it is because exploitation is confirmed and ongoing.

The deeper lesson is the one defenders keep relearning. Security budgets chase the exotic: zero-days, AI-powered attacks, nation-state tradecraft. But this campaign shows the workhorse of state-level intrusion is the boring stuff: known vulnerabilities in common software that were never patched, credentials that were never rotated, Exchange servers that were never hardened. The seven-nation advisory and the Flax Typhoon campaign are a reminder that the most effective defense against sophisticated actors is often the least glamorous: patch the old things, monitor the obvious entry points, and assume that anything Internet-facing is being scanned right now. Because it is.