Expanding Visibility Into Chinese Government-linked Cyber Threat Actors

VulnCheck Canary Intelligence was used to investigate the October 2026 joint advisory on Chinese government-linked threat actors enabled by Integrity Technology Group (Flax Typhoon), revealing that several of the advisory’s IP indicators remain active well past their last-seen dates and have been repurposed against newer vulnerabilities. By analyzing the captured exploitation payloads, the research separates hands-on XWiki attacks from commodity botnet activity and pivots on exposed C2 infrastructure to surface net-new indicators the advisory never listed.