What CISA AA26-281A Actually Shows, and Why It Matters for IoT

What CISA AA26-281A Actually Shows, and Why It Matters for IoT On October 8, 2026, the FBI, CISA, NSA and partners in the UK, Australia, Canada, Japan, New Zealand and Spain published AA26-281A on China-linked activity enabled by Integrity Technology Group. The TTPs are consistent with Flax Typhoon, Ethereal Panda and Red Juliett, though the advisory notes that vendor tracking doesn't map 1:1 to the US Government's.

**Scope note:** Sections 1 to 4 summarize the advisory. Section 5 is analyst opinion and is not in the advisory.

---

1. The chain All technique IDs below are from the advisory (MITRE ATT&CK for Enterprise v19). Stage What the actors did ATT&CK Reconnaissance Open-source scanners (BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, wpscan) plus MicroScan, a Python web app with 1,300+ vulnerability scripts, in use since at least 2017. Scanning focuses on ports 21, 22, 53, 80, 443 and 1080. T1595.002 Initial access Exploit utilities in Python and Go since at least January 2021, plus an XSS payload that rewrites a page into a fake login, harvests credentials, and offers a password-protected zip containing live700\_v1.exe. That executable launches DiagTrack.exe, which shares a name with legitimate Windows software and talks to dns.studiocloud\[.]xyz. T1189, T1059.006, T1059.007 Credential access EBurst sprays and guesses against Exchange across ECP, EWS, OAB, OWA, RPC, MAPI, PowerShell, Autodiscover and ActiveSync. DC.exe performs DCSync against the domain controller. T1110.001, T1110.003, T1003.006 Persistence SoftEther VPN client set to reconnect on startup, often named conhost.exe or dllhost.exe. As legitimate software, it is less likely to be flagged by endpoint tools. T1133, T1036.003, T1059.001 Collection Curlc4.txt, a PHP bot that pulls mail over the EWS API, stages it, and compresses (sometimes encrypts) it before upload. T1114.002, T1074.001, T1560.003 Exfiltration Automated upload to a remote server. office-cli mines Outlook 365 mailboxes using client\_id, tenant\_id and secret values. A custom web app gives third parties access to the stolen mail. T1020, T1059.004

---

2. The vulnerabilities (Appendix B) CVE Vendor / product Type CVE-2014-6278 GNU Bash Remote code execution CVE-2015-3306 ProFTPD 1.3.5 Unauthorized read CVE-2015-5477 ISC BIND 9.x Denial of service CVE-2016-3081 Apache Struts Remote code execution CVE-2019-11510 Pulse Connect Secure Unauthorized read CVE-2021-22205 GitLab Remote code execution CVE-2021-3199 ONLYOFFICE DocumentServer Unauthorized write CVE-2023-22894 Strapi Information disclosure Several were newly added to CISA's KEV catalog with this release. The oldest dates from 2014. This is old, unpatched exposure, not zero-days.

---

3. Who was hit US critical infrastructure: government services and facilities, critical manufacturing, healthcare and public health, and IT US law enforcement, education and religious organizations Victims across Southeast Asia, Africa and North America In some cases, access to exfiltrated data was restricted to IP addresses from Xiamen, China

---

4. Hunt checklist Items marked (advisory) come from the advisory. Items marked (analyst) are standard tradecraft hunts I've added; validate them in your own environment. [ ] Process named DiagTrack.exe running standalone rather than as the legitimate telemetry service (analyst) [ ] conhost.exe or dllhost.exe running outside System32 (analyst) [ ] Outbound connections to softether\[.]net hosts or the SoftEther domains below (analyst) [ ] Unexpected Active Directory replication requests from non-DC hosts (advisory) [ ] Authentication attempts across the Exchange interfaces listed in Section 1 (advisory) [ ] Linux hosts: /var/tmp/.sess.zip, a .run file, a process renamed crypto, HTTP header X-Id (advisory) [ ] Cloud: connected applications with access to mail or file data (advisory) [ ] High upload volume from workstations that normally upload little (advisory) Selected IOCs

The advisory warns that some indicators date back to 2016. Vet before blocking. Full lists are in the STIX files linked on the CISA page. Type Value Context Domain dns.studiocloud\[.]xyz C2 for DiagTrack.exe Domain natcloudservice\[.]com, upl.natcloudservice\[.]com Curlc4 download and C2 (/ews) IP 149.28.132\[.]137 Curlc4 download host SoftEther hosts 98aiblog\[.]com, hmbcloud\[.]com, hmbcloud\[.]net, hmbiplc-01\[.]com, , , , , Advisory Table 12 Staging filenames , , , , , , Exfil staging

File SHA-256 curlc4.txt 8b869a5edaff74ff18bca3658a519a19771e66d00ff7849af7a142dd6fc8da85 DiagTrack.exe 804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d live700\_v1.exe c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec dc.exe 9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00 (SoftEther)

5. My read: where IoT and OT fit This section is analyst opinion, not an advisory finding. AA26-281A does not describe IoT devices, and nothing here should be read as saying it does. But the economics rhyme. These actors win on cheap scanning, reachable services, legacy CVEs and a legitimate-looking persistence tool. A camera-equipped bird feeder, a DVR or a cellular gateway shares those traits: internet-reachable, rarely patched, often default credentials, and no clear owner of its lifecycle. The advisory's own mitigations transfer directly: Replace default passwords with strong ones Retire end-of-life products Run attack surface management to find exposed services Segment edge devices from sensitive resources Apply least-privilege connectivity For OT specifically, CISA's August 2026 advisory AA26-231A is the closer match. It describes active reconnaissance against internet-exposed Siemens S7 PLCs, found through internet scanning services, using AI-generated scripts disguised as legitimate monitoring tools. It also states that PLC targeting activity is broader than Siemens devices. The pattern is the same as in AA26-281A: find exposed, outdated, poorly segmented systems, then probe them. Bottom line: the ground is moving because inventory and lifecycle ownership lag device proliferation, not because of one exotic technique.

---

Source: CISA AA26-281A (October 8, 2026), with the FBI, NSA and international partners. #ThreatIntelligence #CyberSecurity #CriticalInfrastructure #IoTSecurity #IncidentResponse