The UK’s National Cyber Security Centre (NCSC) has joined a multinational warning from cybersecurity agencies, including the FBI, CISA, and NSA, detailing how Chinese government-linked hackers are blending automated scanning with hands-on intrusions to steal sensitive data. The advisory, published on 9 October 2026, highlights the use of legitimate network tools—such as SoftEther VPN and Microsoft Exchange exploits—to evade detection while targeting government, healthcare, and critical infrastructure sectors.
The threat actors, linked to China’s Integrity Technology Group, employ a mix of publicly available scanning tools (Nmap, masscan) and custom scripts to identify vulnerabilities before launching targeted attacks. Once inside networks, they exploit administrative tools to maintain persistent access, often disguising stolen data as ordinary files. The NCSC’s involvement underscores the UK’s direct exposure to these tactics, which have already compromised organisations in the US, Southeast Asia, and Africa.
The advisory warns that attackers use credential-guessing techniques and cross-site scripting to capture login details, then extract emails, calendars, and contacts from compromised systems. By leveraging legitimate software, they reduce the risk of triggering security alerts. The NCSC’s participation in this joint statement reflects growing international concern over state-sponsored cyber espionage targeting critical sectors, including those vital to the UK’s national security and economic stability.
This follows separate advisories in September about China-linked actors using compromised routers to conceal operations, further heightening alerts for UK organisations operating in government, energy, and digital infrastructure.
Key UK impact: The NCSC’s involvement signals that UK businesses and public bodies must now heighten defences against these evolving tactics, which blend automation with manual exploitation to bypass traditional cybersecurity measures.
