FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

The FBI, alongside agencies from six other countries, disclosed a joint advisory on October 8 detailing a long-running Chinese espionage operation tied to Integrity Technology Group, a Beijing-linked firm already sanctioned by the US and UK. Since at least January 2021, hackers associated with the company have broken into government, law enforcement, healthcare, religious and other organizations across Southeast Asia, Africa, and North America—plus US critical manufacturing, education and IT sectors—exploiting eight specific flaws (including CVE-2014-6278, CVE-2019-11510, CVE-2021-22205, and CVE-2023-22894) through tools like the custom MicroScan scanner and open-source utilities Nmap, masscan and WPScan. After breaching networks via password spraying with the EBurst tool, fake login pages, or vulnerable web services, the attackers used SoftEther VPN for persistence, DCSync techniques to harvest credentials, and custom bots (Curlc4, office-cli) to siphon Exchange and Microsoft 365 mailboxes via EWS. Most notably, investigators found the group operates a web application granting unnamed third parties direct access to the stolen email content, raising concerns about a broader data-brokering ecosystem; the advisory includes 39 pages of indicators of compromise and recommends patching affected software, enforcing MFA, and monitoring for unusual Active Directory replication.