FBI, allies warn of China-linked cyber activity and push threat-informed control testing

A new Oct. 8 advisory from the FBI, CISA, NSA and international partners says China-linked actors are combining automated scanning, botnets and hands-on exploitation to steal sensitive data and maintain access. The guidance is pushing defenders to validate exposed services, identity controls, logging and incident response against real attacker behavior, not just policy requirements.

Why it matters: - The advisory gives security teams a current test case for whether defenses work against observed attacker behavior. - The guidance focuses on real-world impact: persistent access, sensitive data theft and exposure across critical infrastructure and other sectors. - Threat-informed validation can reveal gaps that a paper review misses, including missed patches, stale accounts, logging gaps and exposed management interfaces.

What happened: - On Oct. 8, 2026, the FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency and international partners issued a joint advisory on China-linked cyber activity. - The advisory says the actors combined automated scanning with hands-on exploitation to gain persistent access and steal sensitive data. - The authoring agencies tied the activity to Integrity Technology Group, a China-based company with links to the Chinese government. - The analysis draws on technical evidence from multiple FBI investigations.

The details: - The advisory says the actors used open-source scanning tools, a large-scale botnet, VPN infrastructure, known vulnerabilities, password attacks and living-off-the-land techniques. - The agencies identified targeting across U.S. critical infrastructure sectors and other organizations in North America, Southeast Asia and Africa. - Defenders were urged to hunt for the published indicators and activity, strengthen controls and update incident-response plans. - The advisory cautions that commercial names for threat clusters do not always map one-to-one to government attribution. - Related actors may also operate outside the company’s involvement. - Lazarus Alliance said organizations can map the advisory’s techniques to frameworks such as NIST SP 800-53 and ISO/IEC 27001, but should validate controls in the systems and identities most important to their operations.

Between the lines: - The core message is that automated reconnaissance can keep probing the public attack surface while a human operator adapts after gaining a foothold. - That makes annual control reviews less useful if the environment changes after the review. - A control that once worked may fail after a configuration change, an exposed interface, a missed patch or a logging gap. - Threat-informed control validation shifts attention from checklists to whether current defenses can actually withstand current tactics. - Michael Peters, CEO and founder of Lazarus Alliance, said threat intelligence becomes useful when it changes what an organization tests.

What's next: - Organizations should start with internet-facing asset discovery, validation of unsupported or unpatched systems, authentication testing and confirmation that unused services are disabled. - Authorized vulnerability and penetration tests should then examine likely attack paths and layered defenses. - Detection validation should confirm visibility into scanning, unusual account use, credential attacks, lateral movement and attempted access to high-value data. - Incident exercises should test containment, evidence preservation, communications and recovery. - Security teams should also compare current exposure and telemetry with current threat behavior on an ongoing basis.

The bottom line: - The advisory turns a China-linked threat report into a practical playbook for control validation, helping defenders test whether their environment can withstand the tactics attackers are using now.