CISA AA26-281A: How Chinese Government-Linked Actors Steal Sensitive Data

Key Takeaways CISA links China-based Integrity Tech to activity tracked as Flax Typhoon , also called Ethereal Panda or Red Juliett. Targets include US critical infrastructure and organizations in Southeast Asia, Africa, and North America. Initial access combines XSS credential-harvesting pages delivering DiagTrack.exe malware with EBurst password spraying against Exchange.