NSA Warns of New Chinese Cyber Threat Tactics

The agency reports that state-linked hackers now blend automated and manual tools to exfiltrate sensitive network data.

Updated on Oct. 21, 2026 in Cybersecurity

Bold flat-color editorial illustration showing a massive, abstract concrete pylon against a large empty field, evoking institutional systemic threat. — The National Security Agency has issued a new cybersecurity advisory warning of advanced hacking tactics used by state-linked groups targeting critical infrastructure. AI Illustration. Upload story photo >

Live Poll

Do you trust that major public and private networks are sufficiently protected against foreign cyber attacks?

The National Security Agency has issued a new cybersecurity advisory warning that the Integrity Technology Group, which is linked to the Chinese government, is using a hybrid of automated and manual hacking tools to exfiltrate sensitive data. The advisory details specific tactics currently targeting critical infrastructure sectors globally.

Why it matters

This warning aims to help organizations in sectors like manufacturing and healthcare identify and defend against sophisticated, state-linked cyber campaigns. The advisory highlights how blending automated tools with manual hacking allows threat actors to more effectively navigate and exploit complex network vulnerabilities.

The threat actors use a mix of automated and manual hacking tools to breach networks, a technique that improves exfiltration efficiency compared to purely automated scripts. These tactics, techniques, and procedures (TTPs) were formally documented by the NSA as part of their recent intelligence-led assessment.

The players

National Security Agency

The United States intelligence agency responsible for global monitoring, collection, and processing of information for foreign and domestic intelligence purposes.

Integrity Technology Group

A group with documented links to the Chinese government that provides technical support for malicious cyber operations.

The details

The Integrity Technology Group, an entity with links to the Chinese government, utilizes a combined approach of automated exploits and manual techniques to compromise victim systems. Automated tools are used for initial network reconnaissance and vulnerability scanning, while manual intervention allows operators to navigate and extract sensitive data more stealthily once inside. These methods are consistent with the known activity profiles of groups such as Flax Typhoon, Storm 919, Ethereal Panda, and Red Juliett.

October 8, 2026: The NSA released the official cybersecurity advisory.

The Tech Race

This disclosure highlights an escalation in the ongoing cyber contest between state-linked actors and national defense agencies. It underscores a strategic move by state-sponsored groups to integrate human-led analysis with automated exploits to bypass standard defensive configurations.

Organizations in government services, critical manufacturing, healthcare, and IT should review their network perimeters against the TTPs outlined in the NSA advisory. IT administrators should prioritize patching vulnerabilities that facilitate the automated scanning methods now being utilized by these threat actors.

The takeaway

The use of hybrid hacking techniques marks a deliberate shift in how state-sponsored groups operate to ensure higher success rates for data exfiltration. Organizations should monitor their network logs for activity matching the procedures attributed to Flax Typhoon and related groups identified in the advisory.