CISA Adds Flax Typhoon Exploited CVEs to KEV

In October 2026, CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following a joint advisory (AA26-281A) from international intelligence agencies. The activity is attributed to Integrity Technology Group, a China-based firm linked to threat actors known as Flax Typhoon, Ethereal Panda, and Red Juliett. The advisory highlights the exploitation of legacy flaws, most notably CVE-2016-3081 in Apache Struts, alongside ProFTPD, ISC BIND, ONLYOFFICE, and Strapi vulnerabilities.

Technically, the actor utilizes a combination of automated scanning tools (e.g., Fscan, masscan) and hands-on-keyboard techniques to gain initial access. For CVE-2016-3081, successful exploitation requires Dynamic Method Invocation (DMI) to be manually enabled, as it is disabled by default in affected Struts versions. Once inside, the actors deploy SoftEther VPN for persistence and PHP scripts to interface with Microsoft EWS APIs for email exfiltration.

This campaign underscores the persistent risk posed by end-of-life (EOL) software and the continued effectiveness of decade-old vulnerabilities in critical infrastructure sectors, including manufacturing, healthcare, and government facilities. The short remediation deadlines issued by CISA reflect the high urgency of these active exploitation campaigns.