Since 2021, the China-linked company Integrity Technology Group, sanctioned by the US and the UK, has been systematically hacking the networks of government agencies, law enforcement, healthcare, critical manufacturing and religious organizations around the world, stealing their email from Microsoft 365 and Exchange and providing third parties with access to it through its own web portal; organizations running these systems and vulnerable web applications must urgently check for signs of compromise and close the exploited vulnerabilities, as set out in the joint advisory by the intelligence services of seven countries on the IC3 website.
Technical details of the attack and tooling
Operator and infrastructure profile
The joint advisory describes Integrity Technology Group as “a commercially run company based in the People’s Republic of China (PRC) with ties to the PRC government” whose employees develop and sell tools, host infrastructure and take part in intrusions themselves [IC3]. In 2024, the US Department of Justice had already taken down an Integrity-controlled botnet of more than 200,000 routers, cameras and other devices, known as Raptor Train, as described in the earlier advisory IC3 2024.
According to the advisory’s authors, the operators’ methods are consistent with activity tracked in the industry under the names Flax Typhoon, Ethereal Panda, RedJuliett and others, although a direct mapping is not asserted. Previously, FBI Director Christopher Wray publicly cited statements by the chairman of Integrity’s board about long-standing intelligence collection for Chinese security services in his 2024 speech. The company itself and China’s Ministry of Foreign Affairs have rejected these accusations.
Initial access: mass scanning and exploitation of web vulnerabilities
The operators build their entry into networks primarily around well-proven tools and known vulnerabilities rather than rare zero-day exploits:
- mass scanning of public hosts using Nmap, masscan, WPScan on ports 21, 22, 53, 80, 443 and 1080;
- use of their own scanner MicroScan (a Python web application with more than 1,300 penetration-testing scripts) against targets such as OpenSSL, Oracle WebLogic, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins and Apache Struts;
- exploitation of eight already known vulnerabilities, some of which have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog for the first time in this joint advisory according to the KEV repository.
The advisory separately mentions a GitLab vulnerability tracked as CVE-2021-22205, for which NVD recommends updating to versions 13.8.8, 13.9.6 or 13.10.3 and above [NVD CVE‑2021‑22205]. For Strapi, versions 3.2.1 through 4.7.9 are considered vulnerable, and the fix is included in release 4.8.0, which Strapi describes separately in its advisory on its official website. For Apache Struts, the risk can be mitigated either by updating or by disabling the Dynamic Method Invocation mechanism in line with bulletin S2‑032 on the Apache wiki.
At this stage, vulnerable web applications and outdated versions of infrastructure software are the main criterion for target selection: the groups are looking less for a specific organization and more for a “good entry point” into any network with interesting data.
Phishing via XSS and loading the malicious DiagTrack.exe
In addition to exploiting server-side vulnerabilities, the operators use attack chains that start with XSS. The FBI discovered an XSS payload that modifies a vulnerable web page by adding a login form to it. Any username and password entered results in a password-protected ZIP archive being delivered with a program called live700_v1.exe.
When run, this program creates a process DiagTrack.exe, masquerading as a legitimate Windows component, and establishes encrypted communications with the domain dns.studiocloud[.]xyz, which the FBI links to Integrity Technology Group. In the bureau’s assessment, the functionality of this malware is focused on working with email data.
Access to Microsoft 365 and Exchange mail: EBurst and password spraying attacks
To harvest credentials at scale, the attackers use password spraying against Microsoft cloud and on-premise email. They use the open-source Python tool EBurst, which targets Microsoft 365 and Exchange interfaces: ECP, EWS, OAB, OWA, RPC, API, MAPI, PowerShell, Autodiscover, Microsoft‑Server‑ActiveSync.
This approach is dangerous because it hits a broad surface (many accounts) with a relatively small number of popular passwords, staying below typical lockout thresholds for failed attempts. For defenders, this means they must monitor not only OWA logons but authentication across all of the above protocols.
Persistence in the network: SoftEther and DCSync
Once they have initial access, the operators establish persistence in the infrastructure and expand their control:
- they install the legitimate VPN client SoftEther, which is less likely to trigger suspicion from security tools; the installer is often renamed to conhost.exe or dllhost.exe, and the client is configured to reconnect automatically at system startup;
- to steal domain credentials they use a tool called DC.exe, which implements the DCSync technique—impersonating a domain controller and sending requests to the Active Directory replication service, corresponding to the MITRE ATT&CK technique “OS Credential Dumping: DCSync” T1003.006.
Through DCSync, the attackers obtain password hashes, group membership information and trust relationships—everything needed for stealthy privilege escalation and lateral movement across the network.
Theft and monetization of email data
The core focus of the campaign is the systematic export of mailboxes and providing third parties with access to them:
- the PHP script Curlc4.txt acts as a bot, interacting with Exchange Web Services (EWS) to export emails, calendars and contacts, then compressing (and sometimes encrypting) the data and sending it to a remote server with the primary command-and-control domain natcloudservice[.]com;
- the office-cli tool periodically returns to already compromised Microsoft 365 accounts, exporting email for new periods; it relies on configuration files with a client ID, tenant ID and secret and uses legitimate access methods, masquerading as standard integrations;
- in a number of cases, operators have been observed manually exporting databases and email archives.
At the next level, the attackers use their own web application that provides third parties with access to the stolen mailbox contents via URL parameters. In some cases, access to this portal was restricted to IP addresses in the city of Xiamen (China), indirectly suggesting a controlled circle of data consumers.
Threat context and scale
Integrity Technology Group’s activity can be traced back at least to mid-January 2021, with some infrastructure indicators in the advisory dating from 2016. Victims have included:
- US government agencies and law enforcement;
- critical manufacturing, healthcare and IT organizations;
- educational and religious institutions;
- organizations in Southeast Asia, Africa and North America.
Given the focus on email, this is primarily a long-term intelligence-gathering campaign rather than one-off extortion attacks. The third-party portal turns the stolen data into a kind of “subscription service”—which could be an internal platform for consumers within a single ecosystem, or a service for external clients, up to and including pseudo-intelligence outfits or commercial counterparties.
The observed overlap of command-server IP addresses between the 2024 botnet advisory and the new report, despite differing “last seen” dates, shows that the attackers’ infrastructure has a long lifespan and is reused. For defenders, this is a signal not to rely on a single timestamp in an IOC, but to treat such records as long-term indicators for continuous threat hunting.
Impact assessment for organizations
Organizations with the following characteristics are at greatest risk:
- deployed Microsoft 365 or Exchange (including hybrid configurations);
- outdated versions of Struts, GitLab, ONLYOFFICE, Strapi and other products listed in the advisory without current patches;
- publicly accessible admin panels and APIs on ports 21/22/53/80/443/1080;
- insufficient control over applications with access to email and files in the cloud.
Likely consequences if no action is taken:
- compromise of executive and IT staff email, leaking contracts, correspondence with regulators, internal investigations and more;
- undermining trust in email as a channel: interception of one-time codes, password-reset requests and payment confirmations facilitates subsequent BEC fraud and supply-chain attacks;
- escalation to the level of the domain infrastructure via DCSync, creating the risk of total control over the network and insertion of stealthy backdoors;
- legal and regulatory repercussions in sectors with strict requirements for protecting personal and medical data.
Practical defense recommendations
1. Immediate technical priorities (0–7 days)
- Check all hosts for SoftEther installations, especially executable files named conhost.exe and dllhost.exe that do not match the standard locations of system files.
- Analyze DNS and proxy logs for connections to the following domains:
- dns.studiocloud[.]xyz
- natcloudservice[.]com
- In Active Directory, configure monitoring and alerts for:
- atypical directory replication operations;
- use of DCSync by accounts that are not domain controllers and are not in the Domain Admin/Enterprise Admin groups.
- In Microsoft 365 and Exchange:
- enable multi-factor authentication for all accounts with access to email, especially administrators and service accounts;
- review app registrations and the permissions granted to them for accessing email and files, and remove unknown and excessive ones;
- enable auditing and alerts for EWS, MAPI and PowerShell Remoting operations from external IP addresses.
2. Vulnerability remediation (within 2–4 weeks)
- Apply updates for all eight vulnerabilities listed in the joint advisory [IC3 2026‑10‑08], including:
- updating GitLab to versions that fix CVE‑2021‑22205 per NVD;
- updating Strapi to at least 4.8.0 in line with the official Strapi advisory;
- updating ONLYOFFICE DocumentServer to at least version 5.6.3, which is stated to close the corresponding vulnerability per the changelog.
- Disable Dynamic Method Invocation in Apache Struts if updating is not possible, following the Apache S2‑032 recommendation [Apache Struts Security].
- Reduce external exposure of services on ports 21, 22, 53, 80, 443 and 1080:
- restrict admin panels to VPN and allowlisted IP ranges;
- shut down unused services and remove outdated products that no longer receive updates.
- Check your products against the CISA KEV catalog on GitHub and build a prioritized patch plan for vulnerabilities listed there.
3. Hunting for signs of compromise and response
- Conduct retrospective searches using the indicators of compromise from the advisory’s appendix [IC3], using them primarily as hunting material rather than for blanket blocking, given the possible age of some entries.
- If suspicious activity is discovered:
- isolate affected hosts only after collecting key artifacts (logs, memory, VPN and mail agent configurations);
- analyze how deep the attacker has gone (AD, email, databases);
- change all domain and cloud administrator passwords, forcibly log out sessions and revoke OAuth tokens and secrets used by third-party applications;
- rebuild trust relationships between domains if they were compromised via DCSync.
The main practical takeaway is that any Microsoft 365 or Exchange operator with external web applications should, in the near term, combine checking for anomalous Active Directory replication (DCSync), auditing apps with access to email, and applying patches for vulnerable components (GitLab, Struts, Strapi, ONLYOFFICE and others) from the joint advisory—this is the minimum set of actions to reduce the risk of becoming part of Integrity Technology Group’s email showcase.
