FBI says Integrity-linked hackers built email access portal

The FBI and agencies in six other countries issued a joint advisory about activity they linked to Integrity Technology Group, which they described as a China-based company with ties to Chinese government security agencies. The advisory said the same operators had taken email from government, law-enforcement, healthcare and religious organisations in Southeast Asia, and had also targeted bodies in Africa and North America.

The agencies said the operators had been active since at least mid-January 2021. They used open-source scanners, including Nmap, to probe websites and services, guessed Microsoft 365 and Exchange passwords, and in one case lured visitors through a fake login page that delivered malware.

The FBI said the group had also run a web application that let third parties reach stolen email content. For persistence and collection, the hackers used SoftEther, a DCSync-based tool called DC.exe, and mail-collection scripts built from Curlc4.txt and office-cli; some access to the stolen data was restricted to IP addresses in Xiamen, China.

The advisory said its findings came from evidence the FBI gathered across several investigations, and that five of the eight flaws it listed were newly added to the U.S. exploitation catalogue at the time of publication. Integrity Technology Group rejected earlier U.S. accusations in January 2025, and the U.S. Treasury and the UK later sanctioned it.