Last Week’s Joint Advisory Lists Eight Vulnerabilities. The Newest One Is Three Years Old.

On October 8, ten government agencies across six countries published a joint cybersecurity advisory about a long-running intrusion campaign. The FBI, CISA and NSA signed it alongside partners in the United Kingdom, Australia, Canada, Japan, New Zealand and Spain. The advisory is cataloged as AA26-281A, and the FBI hosts the full text.

Most of the coverage focused on attribution. The advisory names Integrity Technology Group, a China-based company with links to the Chinese government, as the enabler behind activity overlapping the actors tracked as Flax Typhoon, Ethereal Panda and Red Juliett.

For a firm administrator, attribution is the least useful part. Two other details matter more.

The way in is old software, and the thing taken is correspondence

The advisory’s Affected Products section lists eight vulnerabilities. They are dated 2014, 2015, 2015, 2016, 2019, 2021, 2021 and 2023. The newest is three years old. The oldest is twelve.

Nothing in that list is a zero-day. Each has had a patch available for years. The campaign works because somewhere in a target’s environment, something is still running an unpatched version and is reachable from the internet.

What the actors do once inside is the second detail. According to the advisory, they target email content from both on-premises and cloud mail systems, account credentials, Active Directory data (including group memberships and trust relationships), and calendar and contact items pulled through the Exchange Web Services API. The FBI observed them downloading mailbox databases outright and, in other cases, pulling messages by hand.

Read that list again with a law firm in mind. Mail, calendars, contacts and the directory that describes who has access to what. At a firm, that is the matter file, the client list and the conflicts picture.

The advisory does not name the legal sector. Its intended-audience section lists government services and facilities, critical manufacturing, healthcare and public health, and information technology. The introduction separately notes targeting of US law enforcement, education and religious organizations. So this is not a bulletin written for law firms, and we are not presenting it as one. It belongs on an administrator’s desk because the entry condition is unpatched software reachable from the internet, and the prize is correspondence. Neither of those is sector-specific.

Three specifics worth knowing

A few of the advisory’s technical observations map directly onto things firms actually run.

Attackers are targeting mail protocols, not just mailboxes. A tool the advisory calls EBurst sprays and guesses passwords against Exchange accounts through Exchange Web Services, Outlook Web Access and ActiveSync. These interfaces often stay enabled long after anyone remembers turning them on, and they are often the paths where multifactor authentication was never fully enforced.

Cloud mailbox access can occur through stored credentials rather than a login. The advisory describes a utility called office-cli that repeatedly accesses Microsoft 365 mailboxes using configuration values the actors already hold, including a client ID, tenant ID, and secret. That is application access, not user sign-in, and it will not show up in a review of user accounts and passwords.

Persistence looks like ordinary software. Actors install SoftEther VPN clients on compromised machines, often under process names like conhost.exe or dllhost.exe, and configure them to reconnect when the machine starts. SoftEther is legitimate software, which is the point of choosing it.

What we do about it

The questions this advisory raises are inventory questions before they are security questions, and answering them is our job rather than yours.

Innovative Computing Systems maintains documentation and an asset inventory for every environment we manage, so we have a standing answer to what is running, what version it is on, and what has passed end of support. That same discipline drove our review of Windows Server 2016 reaching end of support in January. Patch management and monitoring run continuously on top of that inventory, so a system drifting out of support becomes a scheduled decision instead of an exposure nobody is tracking.

On the mail side, we enforce multifactor authentication for webmail and VPN access, which the advisory itself recommends first. We also review application registrations and service principals that hold mailbox permissions in a firm’s Microsoft tenant, because that is the access path the office-cli technique depends on, and it sits outside a normal user account review. Vulnerability management and managed detection provide the other half: finding exposure before someone else’s scanner does, and alerting that treats an unexpected VPN client or an unusual pattern of mailbox access as something to investigate.

Credential theft through people rather than software is part of the same picture, which is why we wrote about fake IT support calls targeting law firms in August, and why two firms recently told regulators their networks held while client files still got out. The logging and inventory that let a firm answer what was reached, and when, are the same foundations in every one of these scenarios. The automation side of the attacker’s toolkit, including scanners that sweep the internet for the exact flaws in this advisory, is a pattern we looked at in new survey data on where law firms stand against AI-assisted attacks. And knowing which outside parties hold firm data remains the companion question, covered in our piece on legal vendors changing hands.

Where this leaves your firm

What makes a twelve-year-old vulnerability useful to an attacker in 2026 is the gap between patch availability and patch application, plus mail interfaces that were never fully locked down. Both are preventable, and your firm deserves better than quietly carrying them.

Innovative Computing Systems has built technology environments for law firms since 1989, and the underlying work has changed less than the threat reporting suggests: keep an accurate picture of what is running, keep it current, control who and what can reach the mail, and notice when something changes. That routine keeps the environment stable, secure, and reliable. That’s the whole point of our partnership. We’ve got your back.

If you want to know what in your environment is old enough to appear on a list like this, you can schedule a consultation with a Solutions Consultant. They will walk through your current systems and where the exposure sits, and tell you plainly what they find.