CISA: Chinese Government-Linked Actors Combine Automated and Hands-on Hacking Tools

What's on the official record

CISA published cybersecurity advisory AA26-281A, "Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data," on 8 October 2026. The advisory reports that Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques. CISA names eight CVEs in the advisory: CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894.

Assessment

For a platform or AI-stack owner, the record lets you check your environment against the eight CVEs CISA names and decide whether to patch or isolate affected systems. CISA attributes the activity to Chinese government-linked actors enabled by the Integrity Technology Group, combining automated scanning, large-scale botnets, and hands-on exploitation, so you can prioritize patching those CVEs and rotate credentials or versions tied to them.

For a cyber underwriter, the record lets you check whether an insured's environment carries any of the eight named CVEs and decide whether to require a control or price the risk accordingly. CISA's attribution of automated scanning, botnets, and hands-on exploitation to Chinese government-linked actors gives you a basis to ask about patch status for those CVEs before binding.

What would change this call

A CISA update to advisory AA26-281A that names additional CVEs, additional agencies, or specific victims would change the scope of the record. A correction to the publication date or the advisory id would change the note.

What to check next

Confidence

Filed 25 October 2026 from the record dated 8 October 2026.

Sources

[1] Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a