Chinese Government-Linked Actors Combine Automated and Hands-On Hacking to Steal Sensitive Data

Oct 8, 2026 · Original article ↗

Summary

A joint advisory details how actors linked to China and Integrity Technology Group target organizations worldwide using automated scanning, exploitation, credential attacks, VPN persistence, and data exfiltration.

Key points

The actors targeted organizations across government, critical manufacturing, healthcare, IT, and other sectors in North America, Southeast Asia, and Africa.
They use scanning tools and a large library of scripts to find vulnerable systems, alongside exploitation and cross-site scripting to harvest credentials.
EBurst conducts password spraying and guessing against Microsoft Exchange interfaces, while other tools target Microsoft 365 email accounts.
The actors install SoftEther VPN clients for persistent remote access and disguise some installers as common Windows executables.
Tools and scripts steal emails and credentials; DC.exe uses DCSync to collect Active Directory credentials and configuration data.
The FBI observed data theft from government, law enforcement, healthcare, and religious organizations; the advisory includes IOCs and technical findings from multiple investigations.
The authoring agencies recommend patching, MFA, input sanitization, least privilege, network segmentation, monitoring, and incident-response measures.

Article Details

Attack Vectors: Automated vulnerability scanning of internet-facing networks and web applications, followed by hands-on exploitation.
Cross-site scripting payloads that replace webpage content with credential-harvesting fields and offer a password-protected archive containing a malicious executable.
Password spraying and password guessing against multiple Microsoft Exchange interfaces.
Installation of VPN clients configured to reconnect automatically at startup, maintaining remote access to compromised devices.
Directory replication abuse to retrieve credentials and other sensitive directory information.
Scripted collection and automated exfiltration of email, calendar, and contact data.
Defensive Notes: Disable unused services and ports, reduce externally exposed application information, and patch exposed systems promptly.
Sanitize web application inputs to prevent cross-site scripting payload injection.
Require multifactor authentication wherever possible, especially for webmail, VPNs, and accounts accessing critical systems; replace default passwords and enforce least privilege.
Monitor for unauthorized living-off-the-land activity, unexpected directory replication, persistent VPN connections, and cloud-connected applications with sensitive data access.
Review web access logs for exploitation and enumeration attempts, and investigate abnormal account activity and unusually high outbound traffic.
Use network segmentation, protective DNS, browser reputation screening, and updated antivirus protection.
If compromise is suspected, isolate affected hosts, collect artifacts, scope the intrusion through threat hunting, and coordinate containment and eviction.
Vet historical indicators before blocking; the advisory notes that some observed indicators date back to 2016.
Test and tune security controls against the concrete adversary behaviors documented in the advisory.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`dns[.]studiocloud[.]xyz`	Domain attributed by the FBI to Integrity Tech; the malicious DiagTrack.exe process establishes encrypted HTTP communications with it.
IPV4	`149[.]28[.]132[.]137`	IP address used when the email-stealing PHP bot downloaded its original file from the upl.natcloudservice host.
SHA256	`0e6fecb2d369b0eae63731616a3daada52036634885ab1b85b115af6bc5bcb86`	Hash of gf.phtml, a webshell from the actors' exploitation repository.
SHA256	`2f5c406eb64ad8902c8e30610d43fd3efc05a14cdb8fb158818953eaf3dc6a81`	Hash of error.jsp, identified as a webshell leveraged by the threat actors.
SHA256	`36f3b7645609ef40444dbc68f01d26c543d67689eda4937272ea5cfa4df1b522`	Hash of yaml-payload.jar, listed among webshell artifacts used for unauthorized access.
SHA256	`456586ababa08f70216c4459f4d6375676166ebfddd98a33b447ceb5099e8dc5`	Hash of back.pl, a webshell from the actors' exploitation repository used for unauthorized victim access.
SHA256	`5782ff2c835c88cc1ee521d2e8c523cfad73db3f9a29c93b40c4223f0338ade9`	Hash listed for the file_back.aspx webshell used for unauthorized access to victim environments.
SHA256	`72c6af6a4be99e31c4a7a0aa4f01750792788e7f6f9749243a9f2c47c14a708f`	Hash of b374.php, a webshell used by the threat actors for unauthorized access to victim environments.
SHA256	`804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d`	Hash listed for malicious DiagTrack.exe, which communicates with infrastructure attributed to Integrity Tech.
SHA256	`8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672`	Hash listed for dllhost.exe, a renamed SoftEther installer associated with unauthorized access on victim systems.
SHA256	`add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489`	Hash of the actor-used office-cli binary associated with automated mailbox access and email exfiltration.
SHA256	`b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e`	Hash of conhost.exe, a renamed SoftEther installer dropped onto victim systems to establish unauthorized persistent access.
SHA256	`c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec`	Hash of live700_v1.exe, the executable delivered inside the XSS-generated archive that starts DiagTrack.exe.
URL	`hxxps[:]//natcloudservice[.]com/ews`	Communication endpoint associated with the email-stealing bot's main C2 domain.
URL	`hxxps[:]//upl[.]natcloudservice[.]com`	Source URL from which the email-stealing PHP bot downloaded its original file.