Chinese Cybersecurity Firm Linked to Widespread Government and Corporate Email Theft
A joint advisory issued on October 8 by the FBI and cybersecurity agencies from six other countries revealed that Integrity Technology Group, a China-based company with alleged ties to the Chinese government, has been orchestrating a large-scale campaign to steal emails from government organizations, law enforcement, healthcare systems, and religious institutions across Southeast Asia, Africa, and North America since at least mid-January 2021.
The U.S. and UK sanctioned the company in January 2025 and December 2025, respectively, for its role in cyber intrusions targeting U.S. victims. Former FBI Director Christopher Wray stated in 2024 that the company’s chairman had publicly acknowledged conducting intelligence collection for Chinese government security agencies.
Attack Methods and Tools
The hackers employed a mix of open-source scanning tools (Nmap, masscan, WPScan) and a custom Python-based scanner, MicroScan, containing over 1,300 penetration testing scripts to exploit vulnerabilities in widely used software, including:
- OpenSSL, Oracle WebLogic, WordPress, Jenkins, and Apache Struts
- Eight known vulnerabilities (five newly added to CISA’s Known Exploited Vulnerabilities (KEV) catalog), some dating back to 2014
They also used password spraying via EBurst, an open-source tool targeting Microsoft 365 and Exchange accounts, and deployed fake login pages via cross-site scripting (XSS) to trick users into downloading malware disguised as legitimate Windows processes.
Persistence and Data Theft
To maintain access, the hackers installed SoftEther VPN, often renaming it to mimic Windows system files. They extracted credentials using DCSync, a technique that abuses Active Directory replication to steal account data.
For email theft, they used:
- Curlc4.txt, a PHP-based bot that collects mail via Exchange Web Services (EWS)
- office-cli, a tool that repeatedly accesses Microsoft 365 accounts to exfiltrate emails over time
- A web application allowing third-party access to stolen emails, though the identities of these parties remain undisclosed
In some cases, access to stolen data was restricted to IP addresses in Xiamen, China.
Botnet Disruption and Ongoing Threats
In September 2024, the FBI dismantled a botnet controlled by Integrity Technology Group, comprising over 200,000 hijacked routers, cameras, and consumer devices. The botnet, dubbed Raptor Train, was linked to the same infrastructure used in the email theft campaign.
While the advisory does not specify the number of breached organizations, it confirms that the hackers’ activities align with threat groups tracked as Flax Typhoon, Ethereal Panda, and RedJuliett, among others. Integrity Technology Group has denied the allegations, calling the U.S. sanctions baseless.
The advisory includes 39 pages of indicators of compromise (IOCs), with some domains and IP addresses dating back to 2016, underscoring the long-term nature of the campaign.
Source: https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html
Integrity360 cybersecurity rating report: https://www.rankiteo.com/company/integrity360
Jenkins Engineering Defence Systems cybersecurity rating report: https://www.rankiteo.com/company/jenkins-engineering-defence-systems
"id": "INTJEN1791491065",
"linkid": "integrity360, jenkins-engineering-defence-systems",
"type": "Vulnerability",
"date": "1/2021",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': ['Government', 'Healthcare', 'Religious'],
'location': ['Southeast Asia',
'Africa',
'North America'],
'type': ['Government Organizations',
'Law Enforcement',
'Healthcare Systems',
'Religious Institutions']}],
'attack_vector': ['Exploiting Known Vulnerabilities',
'Password Spraying',
'Cross-Site Scripting (XSS)',
'Phishing',
'Malware Deployment'],
'data_breach': {'data_exfiltration': 'Yes (via Exchange Web Services, '
'Microsoft 365, and custom web '
'applications)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (government, law enforcement, '
'and healthcare communications)',
'type_of_data_compromised': ['Emails',
'Credentials',
'Personally Identifiable '
'Information (PII)']},
'date_detected': '2021-01-15',
'date_publicly_disclosed': '2024-10-08',
'description': 'A joint advisory revealed that Integrity Technology Group, a '
'China-based company with alleged ties to the Chinese '
'government, has been orchestrating a large-scale campaign to '
'steal emails from government organizations, law enforcement, '
'healthcare systems, and religious institutions across '
'Southeast Asia, Africa, and North America since at least '
'mid-January 2021.',
'impact': {'brand_reputation_impact': 'High (allegations of state-sponsored '
'cyber espionage)',
'data_compromised': 'Emails, credentials, and sensitive '
'organizational data',
'identity_theft_risk': 'High (PII and credentials compromised)',
'legal_liabilities': 'Sanctions imposed by U.S. and UK',
'operational_impact': 'Unauthorized access to sensitive '
'communications and data exfiltration',
'systems_affected': ['Microsoft 365',
'Exchange',
'Active Directory',
'Hijacked routers and IoT devices']},
'initial_access_broker': {'backdoors_established': ['SoftEther VPN (renamed '
'to mimic Windows files)',
'DCSync abuse'],
'entry_point': ['Exploiting known vulnerabilities',
'Password spraying',
'Phishing'],
'high_value_targets': ['Government',
'Law Enforcement',
'Healthcare']},
'investigation_status': 'Ongoing',
'motivation': ['Intelligence Collection', 'Espionage'],
'post_incident_analysis': {'root_causes': ['Exploitation of unpatched '
'vulnerabilities',
'Insufficient authentication '
'controls (e.g., password '
'spraying)',
'Use of open-source and custom '
'hacking tools']},
'references': [{'date_accessed': '2024-10-08',
'source': 'Joint advisory by FBI and cybersecurity agencies '
'from six countries'},
{'source': 'CISA Known Exploited Vulnerabilities (KEV) '
'catalog'}],
'regulatory_compliance': {'legal_actions': ['U.S. sanctions (January 2025)',
'UK sanctions (December 2025)']},
'response': {'containment_measures': ['Botnet disruption (September 2024)',
'Sanctions imposed'],
'law_enforcement_notified': 'Yes (FBI and international '
'cybersecurity agencies)'},
'stakeholder_advisories': 'Joint advisory issued with IOCs (39 pages)',
'threat_actor': 'Integrity Technology Group (allegedly tied to Chinese '
'government)',
'title': 'Chinese Cybersecurity Firm Linked to Widespread Government and '
'Corporate Email Theft',
'type': ['Data Breach', 'Espionage', 'Cyber Intrusion'],
'vulnerability_exploited': ['OpenSSL',
'Oracle WebLogic',
'WordPress',
'Jenkins',
'Apache Struts',
'Eight known vulnerabilities (five newly added to '
'CISA’s KEV catalog)']}