ASD co-signs a ten-agency warning on hackers who break into work email

Australia’s cyber agency has put its name to a ten-agency warning about a hacking operation whose methods include something very ordinary: guessing the password to a work email account.

The joint advisory, published on 8 October 2026, lists the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) as an author alongside the FBI, the US Cybersecurity and Infrastructure Security Agency, the US National Security Agency and agencies from the United Kingdom, Canada, Japan, New Zealand and Spain.

It concerns Integrity Technology Group, which the agencies describe as a China-based for-profit company with links to the Chinese government. The advisory says the company acquires or builds hacking tools, hosts infrastructure and compromises networks. It says the activity is consistent with groups publicly known as Flax Typhoon, Ethereal Panda and Red Juliett, among others, while noting that the names cybersecurity companies use don’t map exactly onto government attribution.

What the advisory says happened

The agencies say the actors targeted victims in four US critical infrastructure sectors: government services and facilities, critical manufacturing, healthcare and public health, and information technology. They also name US law enforcement, education and religious organisations, and organisations across Southeast Asia, Africa and North America.

Australia isn’t in that list. ASD’s ACSC is an author of the advisory, and on our reading the weaknesses it describes exist wherever people use Microsoft 365 or run an internet-facing server.

On the same day, the US Department of Justice announced court-authorised seizures of domains, to deny the hackers access to two tools. One, MicroScan, scanned victim networks for weaknesses. The other, FishHub, is alleged to have helped break into networks through spear phishing, meaning targeted emails, and then downloaded further malware onto them. The department says confirmed FishHub victims included about 20 Taiwanese universities, and that MicroScan’s targets included a US power company, a multinational non-government organisation, and airports in Japan and Poland.

How the break-ins work

The advisory’s technical detail is written for security teams, but the pattern is easy to follow.

Scanning. The advisory says MicroScan has been in use since as early as 2017 and holds more than 1,300 scripts that test websites and services for known weaknesses.

Old, unpatched software. The vulnerabilities the agencies say were successfully exploited aren’t new. They date from 2014 to 2023 and affect products including GNU Bash, Apache Struts, Pulse Connect Secure, GitLab and the Strapi content management system.

Password guessing. The advisory names an open-source tool that tries common and guessed passwords against Exchange and Office 365 sign-in points, including webmail and mobile sync.

Quiet copying of mail. Once inside, one tool described uses a Microsoft email interface to collect email, calendars and contacts. Another is used to continuously access Outlook 365 mailboxes, using configuration files the advisory lists as a client ID, tenant ID and secret. On our reading, those are an application’s credentials rather than a person’s password, which is why the advisory’s instruction to monitor which applications are connected to cloud accounts matters.

What the agencies say to do

The advisory lists 22 mitigations, many of them written for IT teams. On our reading, these are the ones a small organisation or its IT provider can check this week:

• Require multi-factor authentication wherever possible, “particularly for webmail, VPNs, and accounts that access critical systems”, in the advisory’s words.
• Monitor cloud accounts for connected applications that can read files and email.
• Replace default passwords, and limit and audit administrator accounts.
• Apply patches and updates, using automatic update channels from trusted network locations where available, and replace end-of-life products.
• Keep regular backups, password-protect offline copies, and make sure backups can’t be changed from the system they came from.
• Watch for unusual account activity, such as sign-ins outside working hours or from two distant places at the same time.

If your business has an IT provider, send it the advisory and ask which items are already covered. If you look after your own accounts, our guide to setting up two-factor authentication across your business accounts covers the first item, and the Essential Eight in plain English explains ASD’s baseline for patching, backups and administrator access.

If you find signs that a mailbox has already been accessed, such as forwarding rules you didn’t create or a connected app nobody recognises, follow our first-hour guide for a hacked business email account.

Checklist

• Require multi-factor authentication on webmail and VPNs. Ask your Microsoft 365 administrator to require it for every user, and for any account that can reach critical systems.
• Review connected apps. Ask your Microsoft 365 administrator to list the applications that can read mail or files, and remove any that nobody can account for.
• Cut back administrator accounts. Remove administrator rights from anyone who doesn’t need them, and replace any default passwords with strong ones.
• Ask your IT provider about end-of-life products. Get a list of anything that no longer receives security updates, with a date to replace each one.
• Check your backups. Confirm you have regular copies of critical data that can’t be changed from the live system, and that offline copies are password-protected.
• Ask who watches sign-ins. Find out whether anyone reviews logons outside working hours, or from two distant places at the same time.