Backfill. On Oct 8 the FBI, CISA, NSA, NCSC-UK and partners published AA26-281A on actors enabled by China's Integrity Technology Group, whose activity overlaps with Flax Typhoon, Ethereal Panda and Red Juliett. The advisory describes scanning (MicroScan, Fscan, masscan and others), XSS, and password spraying or guessing against Exchange and M365 with the open-source EBurst tool. EBurst hits ECP, MAPI, EWS, OAB, PowerShell, OWA, Autodiscover, RPC and ActiveSync. The actors then persist via VPN software and exfiltrate mail and credentials with scripts. Listed CVEs: CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199 and CVE-2023-22894.

Hunt: (1) Exchange and Entra sign-in failures spread across many of those protocol endpoints for the same accounts in a short window, which is EBurst-style spraying beyond OWA. (2) Web-server hits for the listed old CVEs, which point to unpatched legacy systems. (3) Import the STIX IOCs, but verify them before you block: the advisory warns some date back to 2016. VulnCheck (Oct 13) found three advisory IPs still hitting its canaries as late as May 2026, against different bugs. Hands-on XWiki CVE-2025-24893 exploitation from Taiwan IPs exposed C2 155.138.212[.]170. Hong Kong IP 119.13.79[.]145 is RedTail-family botnet traffic (UA libredtail-http, dropper host 121.176.14[.]102, shared with 177 non-advisory IPs). An IP match alone doesn't prove Flax Typhoon.