China-Linked Corporate Entity Exposed in Unprecedented Email Theft Campaign Across Asia and Beyond
Government bodies, police departments, healthcare networks, and religious groups across Southeast Asia have fallen victim to a sophisticated cyber-espionage operation spanning multiple continents. Authorities from the United States and six other nations revealed on October 8 that the campaign was orchestrated by hackers tied to a Chinese cybersecurity firm. The targeted organizations spanned government services, critical manufacturing, educational institutions, and IT sectors in regions including Southeast Asia, Africa, and North America.
The company at the center of this operation, Integrity Technology Group, has been officially sanctioned by both the United States and the United Kingdom. Described by investigating agencies as a China-based for-profit corporation with clear links to the Chinese government, Integrity Technology Group and its employees are accused of developing, acquiring, and selling cyber tools while hosting attack infrastructure and actively breaching networks. The company has denied these accusations, calling the U.S. sanctions unfounded, while China’s Foreign Ministry stated it firmly opposed the U.S. action.
The threat actors behind this campaign have been active since at least mid-January 2021, employing a wide array of techniques to infiltrate their targets. They frequently scan for network and web application vulnerabilities using open-source tools like Nmap, masscan, and WPScan, focusing on ports 21, 22, 53, 80, 443, and 1080. A key tool in their arsenal is MicroScan, a Python-based web application containing over 1,300 penetration testing scripts. Used since at least 2017, MicroScan has been deployed against a wide range of services, including OpenSSL, Oracle WebLogic Server, WordPress, and Jenkins. Investigators also noted the use of uniquely automated scanning techniques powered by artificial intelligence to identify vulnerable targets.
To gain initial footholds, the hackers leveraged eight known security flaws, several of which were recently added to the official Known Exploited Vulnerabilities catalog. The targeted products and their respective weaknesses include Shellshock in GNU Bash; a vulnerability in ProFTPD; a denial-of-service bug in ISC BIND; a flaw in Apache Struts requiring Dynamic Method Invocation to be active; a critical issue in Pulse Connect Secure; a GitLab vulnerability; an ONLYOFFICE Document Server flaw requiring JWT usage; and a vulnerability in Strapi.
Beyond software exploits, the attackers utilized social engineering and password-based attacks. The FBI discovered a cross-site scripting (XSS) payload that hijacks vulnerable web pages, presenting users with fake login prompts. When a user enters their credentials, they are served a password-protected ZIP file containing a malicious executable. This program disguises itself as a legitimate Windows process and sends encrypted data to a command-and-control server linked to the hackers. Additionally, the group uses EBurst, an open-source tool designed to guess passwords for Microsoft 365 and Exchange accounts by trying common passwords across multiple interfaces, including ECP, EWS, and OWA.
Once inside a network, the attackers establish persistence by installing SoftEther, a legitimate VPN client that security software often overlooks. To avoid detection, they rename the VPN installer to mimic standard Windows system files and configure it to launch automatically on system startup. To steal credentials, they deployed a tool that exploits Active Directory’s replication service to harvest account passwords, group memberships, and trust relationships. For email theft, they constructed a bot from a PHP script, which collects messages via Exchange Web Services, compresses and sometimes encrypts the data, and uploads it to a remote server. A secondary tool continuously returns to Microsoft 365 accounts to scrape emails from various time periods using legitimate access tokens. In some instances, access to the stolen data was restricted to IP addresses in Xiamen, China, and a separate web application was used to provide third parties with access to the purloined emails.
Defenders are urged to immediately hunt for signs of this activity in their networks. Recommended actions include disabling unused services and ports, sanitizing user input to block XSS attacks, and enforcing multi-factor authentication for webmail and VPN access. Organizations are also advised to monitor for unexpected Active Directory replication, review web application logs for attack attempts, and ensure all patches—particularly those for the eight listed vulnerabilities—are applied promptly. Legacy systems that no longer receive security updates should be replaced. If a breach is suspected, affected hosts should be isolated, and a thorough investigation conducted to determine the scope of the intrusion before removing the attackers and hardening the network. Investigators have also compiled extensive indicators of compromise, including domains, IP addresses, and file hashes, some of which have been active since 2016.
FAQ Section
Q: Who is Integrity Technology Group?
A: Integrity Technology Group is a China-based for-profit cybersecurity firm that has been sanctioned by the U.S. and the UK. It is alleged to have ties to the Chinese government, with its employees accused of developing, acquiring, and selling cyber tools used to breach networks and steal data.
Q: What were the primary targets of this hacking campaign?
A: The campaign targeted a wide range of organizations including government agencies, law enforcement, healthcare systems, and religious institutions. The geographic focus was primarily Southeast Asia, though targets were also identified in Africa and North America, as well as U.S. government services, critical manufacturing, and IT organizations.
Q: How did the hackers initially breach these networks?
A: The hackers used open-source scanning tools and a proprietary Python application called MicroScan, which contains over 1,300 scripts, to find vulnerabilities. They also exploited eight specific security flaws (CVEs), deployed fake login pages using cross-site scripting to steal credentials, and conducted password-spraying attacks using an open-source tool targeting Microsoft 365 and Exchange accounts.
Q: What kind of data did the hackers steal?
A: The primary target was email. The attackers used custom PHP bots and legitimate Microsoft 365 access tokens to systematically copy entire mailboxes, calendars, and contacts. The stolen data was often compressed, encrypted, and uploaded to remote servers for exfiltration.
Q: What steps can organizations take to protect themselves from similar attacks?
A: Organizations should disable unused network services and ports, enforce multi-factor authentication (MFA) on all critical accounts, sanitize web inputs to prevent XSS attacks, monitor for unauthorized Active Directory replication, apply all security patches immediately—especially for the eight identified vulnerabilities—and replace any legacy software that no longer receives updates.
Conclusion
The exposure of this long-running cyber-espionage campaign highlights the persistent and evolving threat posed by state-linked cyber operations. By utilizing a mix of legitimate software, custom malicious tools, and exploitation of known vulnerabilities, the threat actors managed to remain undetected within critical networks for years. The international cooperation that led to the identification and sanctioning of Integrity Technology Group underscores the global nature of cyber threats. Ultimately, this operation serves as a stark reminder that proactive defense, rigorous patch management, and constant network monitoring are essential for organizations seeking to safeguard sensitive data against sophisticated adversaries.
Thank you for reading
