Integrity Tech Group Stole Emails via Third‑Party Portal

The FBI announced on Oct 8 that hackers tied to Chinese cybersecurity company Integrity Technology Group stole email accounts belonging to government organizations, law enforcement agencies, healthcare systems, and religious institutions across Southeast Asia. ¹

The agency said it had identified similar activity by six additional countries’ intelligence services, all pointing back to the same portal used by the attackers. ¹

Integrity Technology Group has been sanctioned by both the United States and the United Kingdom since 2024 for comparable operations targeting Western firms’ intellectual property. In this instance, the group’s operators set up a web-based interface that allowed third parties to log into compromised mailboxes without detection. ¹

Investigators found that the attackers scanned publicly exposed websites for misconfigured database credentials using a custom tool that contained additional capabilities for automated exploitation.

This scanning technique—once associated primarily with ransomware affiliates looking for initial footholds—is now being weaponized by state actors, mirroring tactics seen in earlier campaigns against Ukrainian targets starting March of this year.

Security specialists note that the portal likely leveraged a zero‑day vulnerability or social engineering tactics to gain access. Reverse proxies were employed to mask malicious servers, a method documented as part of APT31 operations from early 2019 when they targeted U.S.-based aerospace technology companies. Such practices underscore ongoing concerns about Chinese state actors exploiting smaller cybersecurity service providers with lax security to conduct espionage on behalf of Beijing.

Privacy experts add that the portal probably exploited well-known server flaws such as Log4Shell (2021) or Spring4shell (early 2023), enabling upload and execution of malicious code—a Web Shell access pattern common among Chinese APT groups like TA500. The use of these vulnerabilities highlights how quickly public-facing software can become an attack vector if not promptly patched.

Experts warn that the U.S. Treasury Department may soon designate Integrity Technology Group itself under its Specially Designated Nationals list should it already be absent, further tightening sanctions around this network.