What happened
The FBI and agencies in six other countries said on October 8 that hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia. The company, Integrity Technology Group, has been sanctioned by both the United States and the United Kingdom.
According to the agencies' joint advisory, the hackers scanned websites for flaws using a tool containing more than 1,300 scripts, guessed passwords for Microsoft 365 and Exchange accounts, and copied mailboxes using tools designed to collect mail. The advisory says the activity has been going on since at least mid January 2021 and describes it in the present tense.
The same actors also targeted US government services, critical manufacturing, healthcare, and IT organizations, along with US law enforcement, education, and religious groups. Organizations in Southeast Asia, Africa, and North America were also hit. The hackers run a web application that, in the advisory's words, provides third party access to stolen email content. It does not identify those third parties.
The advisory lists eight known flaws the group exploited, five of which were newly added to the catalog of vulnerabilities known to be used in attacks. Separately, in September 2024 the FBI disrupted a botnet the Justice Department said the company controlled, one that held more than 200,000 routers, cameras, and other consumer devices.
Why this is a GRC story
The third party access portal is the part that changes the risk picture. Stolen data that stays in one actor's hands is bad. Stolen email served up to other parties through an application is a different kind of exposure, because it can be resold, reused, or pointed at new victims. It also means the harm may not stop when the original intrusion is contained.
The tradecraft is boring on purpose. Open source scanners, password spraying against Microsoft 365 and Exchange, a legitimate VPN tool repurposed for persistence, and replicated credentials pulled from a domain controller. None of this is exotic. It is the routine gap between a well configured environment and one that has grown faster than its controls, which is why the advisory leans on basic hygiene in its defender guidance.
Attribution and regulation are now intertwined. The same conduct drives sanctions against the company and a joint advisory for defenders. For compliance teams, that means export and sanctions screening, vendor due diligence, and incident reporting all draw on the same body of public attribution.
What to watch
Watch whether the identified flaws are formally added to the KEV catalog and patched widely, and whether regulators move from advisory to enforcement. Watch also how many of the affected organizations disclose.
The defender guidance is deliberately plain: turn off unused services and ports, sanitise input to block cross site scripting, require multifactor authentication especially for webmail and VPNs, and watch for unexpected Active Directory replication. If you want a fast check this week, confirm that MFA covers webmail and that you would notice an unexpected replication event. Those two items are where this kind of campaign does its damage.
Attribution: Analysis based on The Hacker News and the joint advisory it reports on. This article is original commentary, not a repost of the source material.