As outlined in Infosecurity Magazine, a joint alert from the U.S., UK, and allied nations has detailed the tactics, techniques, and procedures (TTPs) of a sanctioned Chinese organization known as Integrity Technology Group. This group has been linked to prolific Beijing-backed hacking operations, including those by Flax Typhoon, Ethereal Panda, and Red Juliett.
Integrity Technology Group is accused of acquiring and building cyber tools, hosting infrastructure, and compromising global victim networks to support malicious cyber activity. The organization's services contribute to a larger Chinese cyber ecosystem focused on exfiltrating sensitive data worldwide. Their TTPs include using open-source scanning tools and a hacking tool called "MicroScan" to find vulnerabilities. They gain initial access via Python and Go exploit codes, compromise third-party apps using cross-site scripting (XSS) bugs, and use the EBurst tool for password spraying against Microsoft 365 accounts. To maintain persistence and obfuscate command and control communications, they install VPN clients like SoftEther. Data exfiltration involves staging with different file names and using a PHP script called Curlc4.txt to obtain emails. They also use DC.exe to steal Active Directory information and office-cli to continuously access Microsoft Outlook 365 accounts. Targeted verticals include government, law enforcement, healthcare, and religious institutions, primarily in Southeast Asia. Network defenders are advised to disable unused services, sanitize user input in web applications, and implement strong identity and access management policies with multi-factor authentication.
Source: Infosecurity Magazine
