CADChain Blog

Integrity Tech Hacking Advisory: What China-Linked Hackers for Hire Mean for CAD and PLM Data | CADChain | CAD DRM & IP

On 8 October 2026, cyber agencies from seven countries published a joint warning about Integrity Technology Group, a Beijing-based company that sells hacking tools and services linked to the Chinese government. Critical manufacturing is on the list of targeted sectors. The same day, the US Justice Department and the FBI announced that they had seized domains behind two of the company's tools: a vulnerability scanner called Microscan and a spear-phishing platform called FishHub.
The advisory, numbered AA26-281A, is co-signed by US, British, Australian, Canadian, Japanese and New Zealand agencies, and by Spain's National Intelligence Centre (CNI), so it is not only an American story. It describes how people using Integrity Tech's tools combine mass automated scanning with hands-on hacking to steal credentials, email and other sensitive data. Activity has been observed since at least mid-January 2021.
For engineering companies, the uncomfortable part is not the name of the group. It is the method. The attackers did not need clever new exploits. They used old, known vulnerabilities in common servers, password spraying against Microsoft 365 and Exchange, fake login fields and stolen Active Directory data. Those are the same doors that lead to file shares, PDM vaults and the CAD files inside them. Here is what happened and what to do about it.
TL;DR: the Integrity Tech advisory in one paragraph

On 8 October 2026, the FBI, CISA, NSA and partners from the UK, Australia, Canada, Japan, New Zealand and Spain published advisory AA26-281A on Integrity Technology Group, a China-based for-profit company with links to the Chinese government. Its tools and services have been used against government, critical manufacturing, healthcare and IT organisations. The same day, US authorities seized domains used by its Microscan scanner and FishHub phishing platform. FishHub could search victims' systems for specific files and send them to Integrity Tech servers. The seizure does not end the threat. Patch old servers, turn on MFA everywhere, watch your Active Directory, and protect important design files so that a stolen password does not equal a stolen product.

What did the agencies announce on 8 October 2026?

Two things happened at once. First, the joint advisory: a technical document that lists the tools, techniques, exploited vulnerabilities and indicators linked to Integrity Tech, with a long list of mitigations. Its title sums it up: Chinese government-linked actors "combine automated and hands-on hacking tools to steal sensitive data".
Second, the takedown. The Justice Department said that a court in the Western District of Pennsylvania authorised the seizure of domains used to reach Microscan and to deliver FishHub malware. According to the department, Microscan was used "to scan and, in some cases, hack" US and foreign critical infrastructure systems and other networks. Named targets include a power company in South Carolina, Japanese and Polish airports, Taiwanese gas and power companies, and a multinational NGO. About 20 Taiwanese universities were confirmed FishHub victims.
This is not the first action against the company. The US Treasury sanctioned Integrity Tech in January 2025 over its links to the hacking group Flax Typhoon, and the US Attorney for the Western District of Pennsylvania, Troy Rivetti, called the new seizures the "second disruption of Integrity Tech's massive operations in as many years". No criminal charges against the company have been announced.

Who is Integrity Technology Group?

The advisory calls Integrity Tech "a China-based for-profit company with links to the Chinese government". It builds or buys hacking tools, rents and hosts the infrastructure behind them, and compromises networks around the world. The people using its services act in ways consistent with groups that security vendors call Flax Typhoon, Ethereal Panda and Red Juliett.
The business model matters. Brett Leatherman, Assistant Director of the FBI's Cyber Division, put it plainly: "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity." A contractor that sells scanning and phishing as a service can serve many clients at once, which means many targets at once. A mid-sized machine builder does not have to be anyone's main goal to end up in a scan.

Why should manufacturers and engineering teams pay attention?

Critical manufacturing is named explicitly among the targeted sectors, next to government, healthcare and IT. The DOJ release also says that, after a FishHub compromise, additional malware either gave clients remote access or searched for specific files and sent them to servers controlled by Integrity Tech. The authorities did not say which files were taken. But for a company whose value sits in drawings, 3D models and process know-how, "searched for specific files" is the sentence that matters.
We have written before about the tactics behind industrial espionage and CAD file theft. This advisory shows the industrial version of it: automated tools sweep the internet for weak servers, and humans follow up where the scan finds a way in. Our older piece on what the European Commission hacks teach startups makes the same point from the EU side: if large institutions get breached, small engineering firms are not out of reach.

How did the attackers get in?

The list of exploited vulnerabilities in the CISA advisory is striking because it is so old. It includes a 2014 Bash flaw, ProFTPD and BIND bugs from 2015, Apache Struts from 2016, Pulse Connect Secure VPN from 2019, GitLab and ONLYOFFICE Document Server from 2021, and the Strapi content system from 2023. Five of them were added to CISA's Known Exploited Vulnerabilities catalogue with this advisory.
Several of these are tools engineering teams actually run. Self-hosted GitLab often holds firmware, scripts and design automation. Document servers hold specifications. VPN gateways guard the way to the PDM vault. The other techniques are just as familiar: password spraying against Exchange and Office 365, cross-site scripting that injects fake username and password fields into vulnerable websites, copying Active Directory credentials and trust relationships with DCSync, and hiding SoftEther VPN clients under Windows-like names such as conhost.exe. The advisory notes that these techniques "are not unique to Chinese threat actors".
Attack stepWhat the advisory describesWhat it means for CAD and PLM data
ScanMicroscan with more than 1,300 scripts, plus open-source scanners, sweeping common ports.Any internet-facing server, from old FTP to a forgotten test PDM, can be found.
Exploit old flawsKnown CVEs in GitLab, ONLYOFFICE, Strapi, Struts, Pulse Secure VPN, ProFTPD, BIND, Bash.Unpatched dev and document servers become the entry to design data.
Steal loginsPassword spraying on Exchange and Office 365; fake login fields injected via XSS.One reused password can open email, cloud drives and vault accounts.
Take the directoryDCSync copies Active Directory credentials, group memberships and trusts.Whoever owns AD owns every file share and PDM permission tied to it.
Stay hiddenSoftEther VPN disguised as conhost.exe or dllhost.exe; living-off-the-land tools.Data can leave slowly over what looks like normal traffic.
CollectEmail exfiltration; FishHub malware searching for specific files.Drawings and models are copied without anyone opening a CAD tool.

Does the domain seizure solve the problem?

No, and the authorities do not claim it does. Seizing domains cuts off access to tools for a while, but the advisory itself warns that many of its indicators go back years, and attackers can set up new infrastructure. The company has already been sanctioned once and kept operating. The practical reading for a security or engineering manager is simple: treat the published techniques as a checklist of what will be tried against you, by this group or by others.
There is also an evidence angle. If design data does leak, a company has to show what was taken, when and from where. Logs from a hijacked Active Directory are not much help. File-level access auditing for CAD files and tamper-proof audit trails give an independent record, which matters both for incident reports and for any later IP litigation.
A stolen password should not mean a stolen design. CADChain adds encryption, per-file permissions, access logs and blockchain proof of ownership to CAD files, across CAD systems.

👉 See how CADChain protects design IP

What should engineering teams do now?

  1. Patch or retire old servers. Check the CVE list in AA26-281A against your inventory, especially self-hosted GitLab, document servers, VPN gateways and FTP. Replace end-of-life systems instead of hiding them.
  2. Turn on MFA everywhere. The advisory asks for multi-factor authentication on all services where possible, especially webmail, VPN and accounts with access to critical systems. That includes CAD, PDM and PLM logins.
  3. Watch Active Directory. Alert on unexpected directory replication (the DCSync technique) and on new VPN clients or processes with system-like names.
  4. Shrink what is exposed. Disable unused services and ports, sanitise input on web apps to stop XSS, and keep design repositories off the open internet. Our guide to cloud storage security for CAD files covers the common mistakes.
  5. Train against phishing. FishHub is a spear-phishing platform. Our article on social engineering attacks targeting CAD data shows what these lures look like for engineers.
  6. Protect the files, not just the network. Encrypt sensitive CAD files and apply view, edit, print and export permissions that travel with each file, in line with a zero trust model for CAD distribution. Then a copied file is still locked.
None of these steps is new, and that is the point. The attackers in this advisory succeeded with old flaws and weak passwords. The malicious CAD file flaws we covered this month show the other side: once inside, attackers can also use engineering tools themselves. And as the OpenAI hidden recording device case showed, the threat does not always come from outside.

What about EU rules?

Spain's intelligence service co-signed the advisory, and the same techniques work against EU companies. For manufacturers that make software or connected products, the EU Cyber Resilience Act already requires reporting of actively exploited vulnerabilities in their own products; see our explainer on Cyber Resilience Act reporting. For design data shared with partners abroad, the debate over third-country risk is also live in Brussels, as covered in our article on Data Act trade secrets and the Digital Omnibus. In both cases, knowing who accessed which file, from where, is the evidence regulators and courts will ask for.

How does this fit the bigger picture?

This week our sister sites looked at other ways that access to design work is changing, through AI agents, cloud platforms and digital doubles.

Conclusion

The 8 October advisory and seizure put a name and a business model on a threat many engineering firms still think is abstract. A Chinese government-linked contractor sold scanning and phishing at scale, hit critical manufacturing among other sectors, and used old vulnerabilities and weak passwords to get in. Taking down a few domains slows it down. It does not change the method.
The defence is equally unglamorous: patch, enforce MFA, watch the directory, limit exposure, and make sure your most valuable design files stay protected and traceable even after an intruder gets past the network. If a file can only be opened by the right person, on the right device, and every open is recorded, a breach becomes an incident instead of a loss of your product.
Make every CAD file prove who opened it. CADChain gives engineering teams file-level access control, access logs and blockchain proof of ownership for CAD files, across CAD systems.

👉 See how CADChain works

FAQ: the Integrity Tech advisory and CAD data security

What is advisory AA26-281A?

A joint cybersecurity advisory released on 8 October 2026 by the FBI, CISA, NSA and partner agencies from the UK, Australia, Canada, Japan, New Zealand and Spain. It describes tools and techniques linked to Integrity Technology Group and lists mitigations.

What is Integrity Technology Group?

The advisory describes it as a China-based for-profit company with links to the Chinese government that builds hacking tools, hosts infrastructure and compromises networks. The US Treasury sanctioned it in January 2025 over links to Flax Typhoon.

Was manufacturing targeted?

Yes. Critical manufacturing is one of the sectors named in the advisory, together with government services, healthcare and information technology. No individual manufacturing victims were named.

What were Microscan and FishHub?

Microscan is a vulnerability scanner used to find and in some cases hack systems. FishHub is a spear-phishing platform; after a compromise, its malware could give remote access or search for specific files and send them to Integrity Tech servers. US authorities seized domains used by both on 8 October 2026.

Is the threat over after the seizure?

No. Domain seizures disrupt access to the tools, but no charges against the company have been announced and the techniques can be reused with new infrastructure. Treat the advisory as a checklist.

Which vulnerabilities should we check first?

The CVEs listed in the advisory, including GitLab CVE-2021-22205, ONLYOFFICE Document Server CVE-2021-3199, Strapi CVE-2023-22894 and Pulse Connect Secure CVE-2019-11510, plus older Bash, ProFTPD, BIND and Apache Struts flaws.

How does file-level protection help?

Network defences can fail. If sensitive CAD files are encrypted with per-file permissions and access logs, a copied file stays locked and every access attempt leaves evidence, which supports incident response and IP claims.
2026-10-18 13:25 News