VulnCheck Finds Joint Advisory Chinese Threat Actor IPs Still Active in May 2026

VulnCheck Canary Intelligence research reveals that several IP address indicators from an October 2026 joint government advisory remain active and are being used to exploit new vulnerabilities. The analysis shows that infrastructure previously attributed to Chinese government-linked threat actors is still operational years after its last recorded sighting in the original report.

The joint advisory, published on October 8, 2026, by the FBI, CISA, NSA, NCSC-UK and partners in Australia, Canada, Japan, New Zealand and Spain, details how actors enabled by Integrity Technology Group combine automated and hands-on tools. VulnCheck found that three specific IPs from that advisory hit its vulnerable host sensors in May 2026, targeting entirely different software flaws than those listed in the government warning.

Infrastructure Repurposing and Actor Distinction

The original advisory cautioned that many of its indicators dated back to 2016 and recommended vetting before blocking. VulnCheck’s data confirms that three IPs, last seen in the advisory between March 2023 and May 2024, were active in May 2026. None of the vulnerabilities targeted by these active IPs overlapped with the advisory’s list, leading researchers to conclude the hosts have been repurposed for new campaigns.

The research separates two distinct operational styles among the active indicators. Two IPs associated with Taiwan conducted hands-on exploitation of XWiki, specifically targeting CVE-2025-24893 to escalate privileges and establish reverse shells. This manual approach contrasts sharply with the activity observed from a Hong Kong-linked IP.

The Hong Kong IP was identified as part of a RedTail-family botnet. Its dropper was shared with 177 non-advisory hosts, indicating broader commodity malware distribution. By pivoting on command-and-control infrastructure exposed in the captured payloads, VulnCheck surfaced net-new indicators, including two additional operator IPs and a C2 server at 155.138.212.170, which were not included in the original joint advisory.

Vulnerability Context and Previous Exploitation

Of the eight vulnerabilities detailed in the October 2026 advisory, five were already known to be exploited in the wild prior to the report’s publication. Four of those had been exploited years earlier, and two were associated with botnet or ransomware campaigns. The advisory provided new public insight into only three vulnerabilities that had not previously been reported as exploited.

Activity targeting CVE-2021-22205, mentioned in the advisory, appears linked to the Rondodox botnet, which VulnCheck notes is likely unrelated to the Flax Typhoon actors. This distinction highlights the complexity of attributing specific exploits to specific threat groups when multiple campaigns overlap in the same threat landscape.

The finding that old indicators are being repurposed for new attacks reinforces the need for continuous validation of threat intelligence rather than relying on static lists from past advisories.

What should you do?

Security teams should validate IP indicators from older advisories against current telemetry before implementing blocks, as old infrastructure may be repurposed for unrelated campaigns. Organizations should monitor for exploitation of XWiki vulnerabilities, particularly CVE-2025-24893, which was actively targeted by hands-on actors in this investigation. Defenders should also look for signs of RedTail botnet activity, such as droppers shared across multiple non-advisory hosts, and pivot on any observed command-and-control traffic to identify new infrastructure.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: VulnCheck

• Cross-reference IP indicators from historical advisories with current network logs to determine if they are still active or have been repurposed by other threat actors.
• Patch XWiki installations to address CVE-2025-24893 and monitor for unauthorized reverse shell attempts that indicate hands-on exploitation.
• Inspect inbound traffic for signatures associated with RedTail botnet droppers and isolate hosts communicating with known command-and-control infrastructure.
• Review firewall rules and intrusion detection system signatures to ensure they cover net-new indicators, such as the C2 server 155.138.212.170, identified in recent research.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are the IP addresses from the October 2026 joint advisory still active?

Yes, VulnCheck found that three IP addresses from the advisory were observed attacking vulnerable hosts as recently as May 2026.

Did the active IPs target the same vulnerabilities as listed in the original advisory?

No, the active IPs targeted entirely different vulnerabilities, suggesting the infrastructure was repurposed for new campaigns unrelated to the original advisory’s scope.

What types of attacks were observed from the active IP addresses?

Researchers observed hands-on exploitation of XWiki from Taiwan-linked IPs and automated RedTail botnet activity from a Hong Kong-linked IP.