cyber espionage4 articles
China's Integrity Technology Group Ran a Stolen Email Portal for Third Parties, Say FBI and Six Allies
Hackers linked to Chinese cybersecurity firm Integrity Technology Group have been stealing emails from government agencies, healthcare systems, law enforcement, and religious institutions across multiple regions since at least 2021, according to a joint advisory from the FBI and six other countries. The group exploited known software vulnerabilities, used password-spraying tools, and deployed legitimate software like SoftEther VPN to maintain access, while also operating a web portal that gave third parties access to the stolen email content. The U.S. and UK have sanctioned Integrity Technology Group, and authorities are urging organizations to apply patches, enforce multifactor authentication, and monitor for signs of compromise.
DoJ Quietly Walks Back Claim That Major US Agencies Were Hacked by Chinese Group
The U.S. Department of Justice corrected a press statement to clarify that several federal agencies, including NASA, the Federal Reserve, and the DoJ itself, were *targeted* by Chinese state-linked hacking group QTFY rather than confirmed *victims*, a distinction suggesting not all targeted organisations were successfully compromised. QTFY, operating through a private Chinese company with ties to the Ministry of State Security, has been active since 2018 and provides cyber espionage tools — including a vulnerability scanning platform and an obfuscation network — used to attack critical infrastructure in the U.S. and abroad. The FBI has since seized domains linked to the group's key tools, while investigators revealed QTFY also operates a botnet of compromised IoT devices to mask the origins of its malicious traffic.
QUICAgent Backdoor Targets Myanmar Government in Multi-Stage Espionage Campaign
is a China-linked cyber espionage campaign targeting Myanmar's government and IT sectors, using deceptive lures such as graduation ceremony invitations and holiday calendars to trick victims into executing malware. The multi-stage infection chain abuses legitimate Windows tools like `ftp.exe` to reconstruct and deploy a custom Go-based backdoor called **QUICAgent**, which communicates with its command-and-control server via the QUIC protocol and supports file transfer, command execution, and directory browsing. Separately, the China-linked Mustang Panda group has been observed deploying an updated version of the **COOLCLIENT** backdoor featuring a new kernel-mode driver that enhances stealth by hiding malicious processes and protecting related files from detection.
Daxin Is Back, and It Brought a Friend: Meet Stupig, the Pre-Login Backdoor Nobody Saw Coming
A China-linked advanced malware called Daxin has resurfaced at a Taiwan manufacturing firm in 2026, over four years after it was first publicly documented, alongside a newly discovered backdoor called Stupig that hides within the Windows logon process to execute commands with SYSTEM privileges before any user signs in. Both tools carry 2013 compilation timestamps, raising the possibility the intrusion went undetected for up to 13 years. Separately, a suspected China-linked actor has also been observed using AI tools, including Anthropic's Claude Code and DeepSeek, to automate cyberattacks against government and financial targets across multiple countries.