Somewhere in Southeast Asia, a police department or a hospital IT team may have had its mail quietly copied out of its own servers. That is the picture the FBI and agencies from six other countries painted on October 8, when they published a joint advisory on hackers tied to a Chinese company, Integrity Technology Group.
The advisory says the hackers stole email from government bodies, law enforcement agencies, healthcare systems and religious institutions in Southeast Asia. The same group also went after U.S. government services, critical manufacturing, healthcare and IT organizations, plus U.S. law enforcement, education and religious groups. Targets in Africa and North America are listed too. The agencies say the intrusions have run since at least mid-January 2021, but they give no date for any single theft and do not say how many organizations were hit.
A portal for third parties
The detail that gives the advisory its edge is a web application the hackers run, which “provides third-party access to stolen email content.” The agencies do not name those third parties. According to the advisory, users can pull up the mail of a specific account by adding arguments to a URL.
How they get in
The toolkit starts with scanning. The hackers probe websites for flaws with open-source scanners such as Nmap, masscan and WPScan, and with MicroScan, a Python application of more than 1,300 penetration testing scripts that they have used since as early as 2017. They guess passwords against Microsoft 365 and Exchange accounts, and they copy mailboxes with tools built to collect mail. The FBI also recovered a fake login: a script that rewrites a vulnerable page to show username and password fields, then offers a ZIP file holding malware.
The agencies call Integrity Technology Group a China-based for-profit company with links to the Chinese government. The U.S. Treasury sanctioned it in January 2025 for its part in computer break-ins against U.S. victims, and the UK followed in December 2025. In September 2024 the FBI disrupted a botnet of more than 200,000 routers, cameras and other consumer devices that the Justice Department said the company controlled. The company rejected the U.S. accusations in January 2025, telling the Shanghai Stock Exchange that the U.S. move had no factual basis, the Associated Press reported.
The advisory says the methods are consistent with activity that security firms track as Flax Typhoon, Ethereal Panda and RedJuliett, though those labels may not match U.S. government tracking one-to-one.
What defenders are told to do
The agencies urge organizations to require multifactor authentication, especially for webmail, VPNs and accounts that reach critical systems, and to turn off unused services and ports. They also advise sanitizing user input in web applications, patching the eight flaws the advisory lists and replacing products that no longer get updates. The document carries 39 pages of indicators of compromise, some dating to 2016.
