China's Integrity Technology Group Ran a Stolen Email Portal for Third Parties, Say FBI and Six Allies
A Chinese cybersecurity company with documented ties to Beijing has been running what amounts to a hacked email subscription service, letting third parties browse stolen inboxes through a web application. That's among the more striking details in a joint advisory published October 8 by the FBI and agencies from six other countries.
The company is Integrity Technology Group, already sanctioned by the US Treasury in January 2025 and by the UK in December of the same year. The advisory describes a sustained intrusion campaign stretching back to at least mid-January 2021, targeting government bodies, law enforcement, healthcare systems, and religious institutions across Southeast Asia, Africa, and North America. US targets included critical manufacturing, IT, education, and federal services.
Who exactly these people are, in specific terms, the advisory refuses to say. It uses the catch-all phrase 'the threat actors' throughout, declining to attribute individual break-ins to either the company or whoever it may have hired. Security researchers track the group under names including Flax Typhoon, Ethereal Panda, and RedJuliett. Microsoft originally flagged Flax Typhoon in 2023 as a China-based group targeting Taiwanese organisations.
Former FBI director Christopher Wray said in 2024 that the company's chairman had publicly admitted collecting intelligence and conducting reconnaissance for Chinese government security agencies. Integrity Technology Group's response was to tell the Shanghai Stock Exchange the accusations had no factual basis. China's Foreign Ministry called the sanctions unjustified.
The advisory does not specify how many organisations were breached or when particular thefts occurred. For a document spanning several years of activity, that's a notable gap.
Getting In
The initial access playbook is not exotic. The hackers scan networks with common open-source tools like Nmap, masscan, and WPScan, probing standard ports. The agencies note that relying on publicly available tools suggests they tend to go after softer targets rather than hardened ones.
They also use MicroScan, an in-house Python web application with over 1,300 penetration testing scripts, reportedly in use since 2017. It's been deployed against OpenSSL, Apache Struts, WordPress, Oracle WebLogic, Juniper ScreenOS, Jenkins, and others.
The advisory lists eight vulnerabilities confirmed as successfully exploited. The oldest is CVE-2014-6278, a GNU Bash flaw over a decade old. Others include CVE-2019-11510 in Pulse Connect Secure, CVE-2021-22205 in GitLab, and CVE-2023-22894 in Strapi. Five of the eight are described as newly added to CISA's Known Exploited Vulnerabilities catalogue, though they weren't visible in CISA's published data when checked shortly after the advisory dropped.
Two of the flaws are conditional. The Apache Struts vulnerability only works when Dynamic Method Invocation is enabled. The ONLYOFFICE flaw requires JWT to be in use. Worth knowing if you're doing triage.
The hackers also use a credential-harvesting XSS payload that rewrites a vulnerable webpage to display fake login fields. Anyone who enters credentials gets offered a password-protected ZIP containing a file called live700_v1.exe, which spawns a process named DiagTrack.exe to blend in with legitimate Windows processes, then phones home to a domain the FBI attributes to Integrity Technology Group. The malware is assessed to target email.
For cloud accounts, they run EBurst, an open-source Python tool for password spraying Microsoft 365 and Exchange. It targets a wide range of Exchange interfaces including OWA, EWS, MAPI, and ActiveSync, among others.
Staying In and Taking the Mail
Persistence is maintained through SoftEther, a legitimate VPN client that security tools are unlikely to flag. The hackers rename its installer to match common Windows filenames like conhost.exe or dllhost.exe and configure it to reconnect on startup.
For credential theft, they use DC.exe to run DCSync attacks against domain controllers, pulling account hashes, group memberships, and trust relationship data through Active Directory's replication mechanism.
Mail collection runs through two routes. The first is a PHP-based bot built from a script called Curlc4.txt that pulls email, calendars, and contacts via Exchange Web Services, compresses the haul, sometimes encrypts it, and uploads it to a remote server. The second is office-cli, a tool that returns repeatedly to Microsoft 365 accounts across different time periods using legitimate API access, making it harder to detect.
In some cases, access to the stolen data was restricted to IP addresses in Xiamen. The third-party web portal lets users pull up a specific account's email just by modifying a URL parameter. Tidy.
Defenders' Checklist
The agencies recommend the usual but genuinely important steps: disable unused services and ports, enforce MFA for webmail and VPNs, sanitise web app inputs to block XSS, watch for unexpected Active Directory replication activity, audit cloud apps with access to email and files, and patch the eight listed vulnerabilities. Any product that no longer receives updates should be replaced, not patched around.
For confirmed compromises, the recommended sequence is isolation first, then thorough investigation before eviction, to avoid tipping off the attackers before you understand the full scope.
The advisory includes 39 pages of indicators of compromise covering domains, IP addresses, and file hashes. Some date to 2016. A few caveats apply: ten IP addresses in the new list also appeared in the September 2024 advisory on the Raptor Train botnet, but with different 'last seen' dates that are actually earlier than those in the older document. In short, the timestamps are not always reliable, and defenders should treat the IOC list as a starting point rather than a definitive record.