Federal investigators say China-linked hackers operated a web portal that let outside users browse stolen government email accounts by simply changing a web address. A joint advisory from CISA, the FBI, the NSA, and six partner-nation agencies, including Australia's ASD, ties the operation to a China-based company called Integrity Technology Group, according to the CISA/FBI joint advisory AA26-281A, released October 8, 2026. The advisory describes a web application built for exactly this purpose: giving third parties access to the content of compromised email accounts. A user could view a stolen mailbox by passing arguments directly in a URL, according to the advisory's description reported by iTnews, though the document does not name who those third parties were.
Table of Contents
- What the Portal Did and Who Built It
- How the Hackers Got In
- Who Was Affected
- The U.S. Response: Domain Seizures and a Prior Takedown
- What Network Defenders Should Do Now
What the Portal Did and Who Built It
The portal functioned as a lookup tool for stolen mail. Rather than exporting data files, the hackers set up a system where anyone with access could enter the right URL parameters and read a specific victim's email, according to the iTnews report on the advisory. That design suggests the stolen data was meant to be queried on demand rather than simply dumped in bulk. Investigators attribute the activity to a hacking group tracked under multiple names: Flax Typhoon, Ethereal Panda, and Red Juliett. The advisory links that group's infrastructure to Integrity Technology Group, the China-based firm named in the joint alert, per the same iTnews coverage.
This is not the first time U.S. authorities have named Integrity Technology Group. The U.S. Treasury's Office of Foreign Assets Control sanctioned the firm on January 3, 2025, under Executive Order 13694 as amended by 13757, after finding its infrastructure was used by Flax Typhoon in intrusions against U.S. victims between summer 2022 and fall 2023, according to the Treasury Department's press release. That sanction blocks the company's assets in the United States.
How the Hackers Got In
The campaign did not rely on a single flaw. According to The Hacker News' reporting on the advisory, the hackers have broken into victim networks since at least mid-January 2021 by exploiting known vulnerabilities in Apache Struts, GitLab, and Strapi.
Once inside a network, the group moved toward email systems specifically. They used password-spraying, a technique that tries common or previously leaked passwords against many accounts at once, and scanned for additional weaknesses to reach Microsoft 365 and Exchange mailboxes, per the same Hacker News report. The combination of old software flaws and credential attacks let the campaign persist for years in some networks before detection.
Who Was Affected
The advisory and related reporting name a broad set of victim categories rather than specific organizations. Targets included government, law enforcement, healthcare, and religious organizations across Southeast Asia, with additional victims in Africa, North America, and U.S. critical infrastructure sectors, according to a summary of the advisory from Picus Security.
Neither the advisory nor the secondary reporting specifies a total victim count or exact breach dates for individual organizations. The geographic and sector spread points to an operation built for broad access rather than a single target. Government and law enforcement agencies are especially sensitive victims, since stolen email from those sectors can expose investigations, policy deliberations, or personnel information.
The U.S. Response: Domain Seizures and a Prior Takedown
Alongside the advisory, the U.S. Justice Department announced a court-authorized seizure of seven domains connected to the group's hacking tools, known as MicroScan and FishHub, according to the iTnews report. Seizing domains cuts off infrastructure the hackers relied on to operate their tools, though it does not undo past intrusions.
This action follows an earlier FBI-led disruption. In September 2024, authorities took down the Raptor Train botnet, which the Justice Department said Integrity Technology Group controlled. That botnet had compromised more than 200,000 routers, cameras, and other consumer and small-office devices, according to The Hacker News. The pattern across both actions shows the same company tied to two distinct types of infrastructure: a device botnet and an email-theft portal.
What Network Defenders Should Do Now
The advisory gives concrete steps for organizations that may be exposed to the same techniques. Because the campaign exploited specific, known software flaws over several years, patching remains the first line of defense.
Organizations in government, law enforcement, healthcare, or critical infrastructure sectors face the highest exposure given the victim pattern described in the advisory. The multi-year dwell time cited in the advisory means a network that looks clean today may have been compromised for years before this disclosure surfaced the activity.
- Patch Apache Struts, GitLab, and Strapi installations to current versions, since these were the exploited entry points, per The Hacker News.
- Enforce multi-factor authentication on Microsoft 365 and Exchange accounts to blunt password-spraying attempts.
- Hunt for password-spraying indicators in authentication logs, since the group has operated undetected in some networks since 2021.
- Review access logs for any email or portal systems that accept URL-based lookups, given the design of the hackers' own tool.
You Might Also Like
- Cybersecurity — Water Utility Hack: What Organizations Should Fix Next
- Cybersecurity — SEC Cyber Disclosure Security Review: Entry Point, Impact, and Lessons
- Cybersecurity — Lazarus Group: What Organizations Should Fix Next