Threat Overview
A joint FBI/CISA/NSA and international-partner advisory published **October 8, 2026** (AA26-281A) documents China-linked actors enabled by Integrity Technology Group combining automated vulnerability scanning, hands-on exploitation, credential attacks, VPN persistence and email-data theft. MicroScan is a Python web application with more than 1,300 penetration-testing scripts; investigators documented exploitation of vulnerable Internet-facing services, XSS payloads that display credential fields, EBurst spraying against Exchange/Microsoft 365 interfaces, SoftEther VPN persistence and mailbox exfiltration via Curlc4.txt and office-cli. FBI investigators recovered `live700_v1.exe` launching a `DiagTrack.exe` process that contacted `dns.studiocloud.xyz`, and reported a `DC.exe` DCSync tool. On October 8, DOJ/FBI seized seven domains supporting MicroScan and FishHub; seizure disrupts known infrastructure but does not establish that every compromised host was remediated or that all actor capabilities ceased. The joint advisory says its observations come from FBI investigations; vendor-independent attribution of every similar event is not possible. ATT&CK: T1595.002, T1110.003, T1059.001, T1133, T1036.003, T1114.002, T1003.006.
References
Joint cybersecurity advisory AA26-281A (FBI/CISA/NSA et al.), October 8, 2026
U.S. DOJ domain seizure and case details, October 8, 2026
BleepingComputer incident reporting, October 8, 2026
Impacted Systems
**Products/services:** Internet-facing web applications and network services scanned by MicroScan (including historically exploited OpenSSL, Oracle WebLogic, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins and Apache Struts), on-premises Exchange and Microsoft 365 identities, Windows/Linux servers and AD domain controllers. **Versions:** No single affected product version range exists for this multi-product intrusion set. The advisory lists observed historical CVEs (CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894); validate individual vendor advisories before assessing exposure. **Deployment/exposure:** Internet-accessible vulnerable services, weak/reused credentials, reachable Exchange interfaces, or post-compromise Windows/Linux endpoints. **Ports:** scanning commonly included TCP/21, 22, 53, 80, 443, 1080, not exclusive exploit ports. **Fixed versions:** Product-specific; no universal remediation build. **Unaffected:** Assets not exposing the relevant services and with patched configurations are not presumed vulnerable to those specific exploit paths, though stolen credentials remain a separate risk.
Why this matters
The new multinational advisory and DOJ seizure provide verified TTPs and indicators with applicability to identity, endpoint, email and perimeter telemetry across MSSP customers.
Exploitation Status
Confirmed: FBI investigations documented scanning, compromise, persistence and exfiltration. Confirmed: DOJ/FBI seized seven supporting domains October 8. Assessment: surviving implants or alternate infrastructure could remain; this is not a verified statement that attacks continue from seized domains.
What this hunt looks for
Unexpected SoftEther deployment, masqueraded system processes, attacker-linked domains, mailbox credential spraying, mail export, directory replication abuse and scanning of Internet-facing services.
Required logs
Use only queries whose listed Sentinel tables are ingested. The hunt set uses: CommonSecurityLog, DeviceFileEvents, DeviceNetworkEvents, DeviceProcessEvents, DeviceProcessEvents + DeviceNetworkEvents, OfficeActivity, SecurityEvent, SigninLogs or AADNonInteractiveUserSignInLogs, Syslog.
Hunt 1: First pass — SoftEther VPN installation and masqueraded execution
Required telemetry: DeviceProcessEvents. High signal when unexpected on servers; legitimate SoftEther or copied filenames need validation.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("vpnclient.exe","vpncmd.exe","vpnserver.exe","conhost.exe","dllhost.exe") or ProcessCommandLine has_any ("SoftEther","vpnclient","vpncmd")
| where ProcessCommandLine has_any ("SoftEther","vpnclient","vpncmd","vpnserver") or (FileName in~ ("conhost.exe","dllhost.exe") and FolderPath !startswith @"C:\Windows\System32\")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated descHunt 2: Confirmed malware names and office-cli process execution
Required telemetry: DeviceProcessEvents. DiagTrack.exe and DC.exe are ambiguous names; paths, signing and lineage matter.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("live700_v1.exe","DiagTrack.exe","DC.exe","office-cli") or ProcessCommandLine has_any ("Curlc4.txt","office-cli","natcloudservice.com","live700_v1.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by TimeGenerated descHunt 3: Confirmed network infrastructure connections
Required telemetry: DeviceNetworkEvents. Domains are historically observed; some were seized, so a match is an investigative lead, not proof of current actor control.
let IOCs=dynamic(["dns.studiocloud.xyz","natcloudservice.com","upl.natcloudservice.com","98aicai.com","98aicode.com","outlook3650.com","youtubecard.com","linkedinns.net","98aiblog.com","hmbcloud.com","hmbcloud.net","hmbiplc-01.com"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| extend Host=tolower(extract(@"^(?:https?://)?([^/:]+)",1,RemoteUrl))
| where Host in (IOCs) or RemoteIP == "149.28.132.137"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| order by TimeGenerated descHunt 4: Microsoft Entra password spraying by IP and user diversity
Required telemetry: SigninLogs or AADNonInteractiveUserSignInLogs. Generic password spray behavior; not uniquely attributable to Flax Typhoon.
union isfuzzy=true (SigninLogs | project TimeGenerated, UserPrincipalName, IPAddress, ResultType, AppDisplayName), (AADNonInteractiveUserSignInLogs | project TimeGenerated, UserPrincipalName, IPAddress, ResultType, AppDisplayName)
| where TimeGenerated >= ago(7d)
| where tostring(ResultType) != "0"
| summarize Failures=count(), Users=dcount(UserPrincipalName), SampleUsers=make_set(UserPrincipalName,5), Apps=make_set(AppDisplayName,5) by IPAddress, bin(TimeGenerated,1h)
| where Failures >= 20 and Users >= 5
| order by Failures descHunt 5: Mailbox access and bulk Exchange activity
Required telemetry: OfficeActivity. Mailbox audit operations vary by license, Exchange environment and ingestion; access counts alone are noisy.
OfficeActivity
| where TimeGenerated >= ago(30d)
| where Operation has_any ("MailItemsAccessed","SearchQueryInitiatedExchange","New-InboxRule","Set-InboxRule","Add-MailboxPermission")
| summarize Events=count(), Operations=make_set(Operation,10), SourceIPs=make_set(ClientIP,10) by UserId, bin(TimeGenerated,1h)
| where Events >= 15 or array_length(Operations) >= 3
| order by Events descHunt 6: Exfiltration staging filenames and scripts
Required telemetry: DeviceFileEvents. Generic file names may be benign; the specific script, folder context and adjacent events matter.
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("Curlc4.txt","live700_v1.exe","DC.exe","001.gif","Include.png","M2k.js","M2k_list.js","M2k_ui_adm.js",".sess.zip","clientid") or FolderPath has_any ("/storage/fm/","/var/tmp/.sess.zip")
| project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated descHunt 7: Possible DCSync operations from non-DC accounts
Required telemetry: SecurityEvent. Requires 4662 auditing and directory replication object access; legitimate replication can produce events.
SecurityEvent
| where TimeGenerated >= ago(30d) and EventID == 4662
| extend Details=strcat(tostring(column_ifexists("Properties",""))," ",tostring(column_ifexists("EventData","")))
| where Details has_any ("1131f6aa","1131f6ad","89e95b76")
| project TimeGenerated, Computer, Account, EventID, Details, Activity
| order by TimeGenerated descHunt 8: External source scanning multiple enterprise ports
Required telemetry: CommonSecurityLog. Only if perimeter events preserve source and destination fields; authorized vulnerability scanners create noise.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (21,22,53,80,443,1080)
| summarize Connections=count(), Hosts=dcount(DestinationIP), Ports=dcount(DestinationPort), SampleDestinations=make_set(DestinationIP,8) by SourceIP, bin(TimeGenerated,1h)
| where Hosts >= 10 and Ports >= 3
| order by Hosts descHunt 9: Linux Syslog SoftEther and remote-fetch fallbacks
Required telemetry: Syslog. Standard syslog may not record command lines; use only when shell/audit events are forwarded.
Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("SoftEther","vpnclient","vpncmd","natcloudservice","Curlc4","office-cli") or (SyslogMessage has_any ("wget","curl") and SyslogMessage has_any ("vpnclient","vpnserver"))
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated descHunt 10: Process-to-network correlation for masqueraded diagnostics
Required telemetry: DeviceProcessEvents + DeviceNetworkEvents. Join by device and PID with bounded time; PID reuse and missing endpoint telemetry can affect results.
let Procs=DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("DiagTrack.exe","conhost.exe","dllhost.exe","vpnclient.exe")
| project DeviceId, ProcessId, ProcessTime=TimeGenerated, FileName, FolderPath, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("DiagTrack.exe","conhost.exe","dllhost.exe","vpnclient.exe")
| join kind=inner Procs on DeviceId, $left.InitiatingProcessId == $right.ProcessId
| where TimeGenerated between (ProcessTime .. ProcessTime+12h)
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated descDetection Notes
- Highest signal: unexpected SoftEther installed as a Windows system-looking binary, the `live700_v1.exe` → `DiagTrack.exe` chain, confirmed domain/host matches, and unauthorized DCSync replication.
- Password spraying and broad network scanning are high-volume techniques but not unique to this actor; suppress authorized scanners and validate source geography, host role and temporal correlation.
- SecurityEvent 4662 requires directory service auditing; Windows 4688 without command lines and Syslog without auditd/shell capture cannot reconstruct execution.
- Exchange EWS or mailbox content access may be invisible if on-premises audit logs, relevant OfficeActivity records or endpoint/network telemetry are not ingested.
- A domain IOC may now resolve to a seizure page; historical hits must be assessed against event time. Missing relevant logs or retention prevents conclusions about those systems.
All conclusions are limited to data sources and retention actually available in Microsoft Sentinel. Absence of matching activity cannot establish absence of compromise on unmonitored assets or in non-ingested logs. No customer-specific Sentinel workspace was queried and no customer-specific finding is asserted.
