Chinese Cybersecurity Firm Linked to Widespread Government and Corporate Email Theft A joint advisory issued on October 8 by the FBI and cybersecurity agencies from six other countries revealed that Integrity Technology Group, a China-based company with alleged ties to the Chinese government, has been orchestrating a large-scale campaign to steal emails from government organizations, law enforcement, healthcare systems, and religious institutions across Southeast Asia, Africa, and North America since at least mid-January 2021. The U.S. and UK sanctioned the company in January 2025 and December 2025, respectively, for its role in cyber intrusions targeting U.S. victims. Former FBI Director Christopher Wray stated in 2024 that the company’s chairman had publicly acknowledged conducting intelligence collection for Chinese government security agencies. ### Attack Methods and Tools The hackers employed a mix of open-source scanning tools (Nmap, masscan, WPScan) and a custom Python-based scanner, MicroScan, containing over 1,300 penetration testing scripts to exploit vulnerabilities in widely used software, including: - OpenSSL, Oracle WebLogic, WordPress, Jenkins, and Apache Struts - Eight known vulnerabilities (five newly added to CISA’s Known Exploited Vulnerabilities (KEV) catalog), some dating back to 2014 They also used password spraying via EBurst, an open-source tool targeting Microsoft 365 and Exchange accounts, and deployed fake login pages via cross-site scripting (XSS) to trick users into downloading malware disguised as legitimate Windows processes. ### Persistence and Data Theft To maintain access, the hackers installed SoftEther VPN, often renaming it to mimic Windows system files. They extracted credentials using DCSync, a technique that abuses Active Directory replication to steal account data. For email theft, they used: - Curlc4.txt, a PHP-based bot that collects mail via Exchange Web Services (EWS) - office-cli, a tool that repeatedly accesses Microsoft 365 accounts to exfiltrate emails over time - A web application allowing third-party access to stolen emails, though the identities of these parties remain undisclosed In some cases, access to stolen data was restricted to IP addresses in Xiamen, China. ### Botnet Disruption and Ongoing Threats In September 2024, the FBI dismantled a botnet controlled by Integrity Technology Group, comprising over 200,000 hijacked routers, cameras, and consumer devices. The botnet, dubbed Raptor Train, was linked to the same infrastructure used in the email theft campaign. While the advisory does not specify the number of breached organizations, it confirms that the hackers’ activities align with threat groups tracked as Flax Typhoon, Ethereal Panda, and RedJuliett, among others. Integrity Technology Group has denied the allegations, calling the U.S. sanctions baseless. The advisory includes 39 pages of indicators of compromise (IOCs), with some domains and IP addresses dating back to 2016, underscoring the long-term nature of the campaign.