On October 8, 2026, the FBI alongside law enforcement agencies across six countries released a joint advisory exposing an active cyber espionage campaign conducted by Integrity Technology Group. According to Thehackernews, the China-based for-profit enterprise operated a dedicated web application designed to grant third-party beneficiaries direct access to stolen email content. The campaign compromised networks across Southeast Asia, Africa, and North America, impacting government entities, law enforcement agencies, healthcare providers, and religious institutions. This structure marks a departure from traditional closed-loop espionage models, where gathered intelligence remains strictly within the handling intelligence cell or sponsoring government apparatus.
Attack Mechanics and Tradecraft by Integrity Technology Group
The threat actors utilized automated toolsets containing more than 1,300 distinct scripts to scan exposed web infrastructure for known flaws. Following initial reconnaissance, the operators executed targeted password guessing attacks against Microsoft 365 and local Exchange accounts. Once inside corporate or government environments, the intruders deployed specialized utility tools to harvest and exfiltrate complete mailboxes.
What specific infiltration methods did Integrity Technology Group use?
The group scanned public-facing websites using custom scripts containing over 1,300 vulnerability checks and performed credential brute-forcing specifically aimed at Microsoft 365 and Exchange services.
Evidence gathered during multiple FBI investigations indicates that these intrusions have persisted since at least mid-January 2021. While the joint advisory outlines the active methods and data collection techniques, it refrains from specifying the precise volume of victim organizations or publishing exact timestamps for individual data exfiltration events. Security analysts must rely on perimeter logs and identity provider audits to reconstruct timelines for targeted tenants.
Infrastructure and Prior Disruption
Integrity Technology Group functions as a commercial contractor with close alignment to Chinese state objectives, employing operators who develop custom exploits, host malicious command infrastructure, and execute network intrusions. The scope of their operations extends beyond corporate email theft into large-scale device hijacking.
In September 2024, the United States Department of Justice and the FBI disrupted a massive botnet known as Raptor Train, which researchers at Lumen attributed directly to Integrity Technology Group. That infrastructure hijacked over 200,000 consumer routers, network cameras, and IoT devices to obscure malicious traffic. Subsequent sanctions from the U.S. Treasury in January 2025 and corresponding UK measures targeted the enterprise for its reckless disregard for international cybersecurity norms, paralleling challenges seen when How SMB Cybersecurity Complexity Threatens Advanced Protection Goals complicates defensive baselines.
How does this campaign relate to previous botnet disruptions?
The same organization controlled the Raptor Train botnet consisting of over 200,000 compromised routers and IoT devices, which the U.S. Justice Department dismantled in September 2024 before issuing the recent intelligence on email harvesting.
Scope of Targets and Third-Party Exposure
The joint advisory confirms that U.S. government services, critical manufacturing sectors, information technology organizations, and educational facilities faced sustained targeting alongside international entities. The existence of the portal for third-party access highlights a distinct operational model where stolen intelligence is packaged or shared beyond the immediate intrusion cell. The advisory does not name the external third parties who accessed the portal, leaving a significant intelligence gap regarding downstream beneficiaries.
Are the third parties using the stolen email portal publicly identified?
No. The joint law enforcement advisory notes the existence of the portal providing third-party access to stolen emails but does not disclose the identities of those external beneficiaries.
Mitigation and Operational Defenses
Defenders operating Microsoft 365 or Exchange environments must prioritize rigorous identity and access management controls. Organizations should audit active mailbox delegation settings, review API application permissions, and enforce phishing resistant multi-factor authentication across all user tiers. Perimeter defenses require continuous monitoring against automated credential stuffing and rapid patching of discovered web application flaws.
Related coverage
- Microsoft Twitter Account Hijacked for Crypto Scam Featuring Clippy
- Threat Actors Exploit AI Chatbot Security Vulnerabilities for Mass Disinformation and Phishing Campaigns
- [Russian Threat Actor UAC-0099 Refines MatchBoil Malware Against Ukrainian Targets](/posts/russian-threat-actor-uac-0099-refines-matchboil-malware-against-ukrainia