FBI Says China-Linked Hackers Stole Emails and Gave Third Parties Access
Summary
A multinational advisory says hackers linked to Integrity Technology Group broke into organizations, stole email and credentials, and operated a portal giving third parties access to stolen mail. It details their methods and urges defenders to investigate networks.
Key points
- The hackers have targeted government, law enforcement, healthcare, religious, education, manufacturing, and IT organizations across multiple regions since at least January 2021; the advisory does not specify how many were breached.
- Methods included scanning for vulnerable services, exploiting known flaws, password spraying Microsoft 365 and Exchange accounts, and using a fake login page to capture credentials.
- The hackers maintained access with SoftEther VPN and used tools to copy domain credentials and collect email from Exchange and Microsoft 365.
- The advisory says the hackers operated a web application that allowed third parties to access stolen email; it does not identify those third parties.
- The FBI linked malware delivered through a fake login page to a domain attributed to Integrity Technology Group and assessed that the malware likely targets email.
- The agencies recommend investigating networks for indicators of compromise and, after gathering evidence, isolating affected hosts, removing the attackers, and hardening systems.
Article Details
- Event Type
- Joint advisory alleging that hackers enabled by Integrity Technology Group breached networks, stole email and credentials, and operated a web application providing third parties access to stolen email.
- Impact
- Government organizations, law enforcement, healthcare systems, religious institutions, and other organizations were affected or targeted. The source gives no confirmed victim count or total amount of data stolen; the web application enabled third-party access to stolen email.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dns[.]studiocloud[.]xyz | Domain the FBI attributed to Integrity Technology Group; the program sent encrypted traffic to it. |
| DOMAIN | natcloudservice[.]com | Identified as the main command-and-control domain for the mail-collecting bot. |
People
Threat Actors
Ethereal PandaThe advisory said the hackers' methods were consistent with activity tracked by this name; it did not establish that all activity was by this group.Flax TyphoonThe advisory said the hackers' methods were consistent with activity tracked by this name; it cautioned that tracking names may not match the U.S. government's one-to-one and did not establish that all activity was by this group.Integrity Technology GroupThe advisory describes the company as linked to the hackers it enables and uses “the threat actors” to refer to both the company and those hackers; the source does not assign individual break-ins to one or the other.
Products
Apache Strutsincluding OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.BINDThe BIND flaw is a denial-of-service bug that makes the DNS server exit.Jenkinsagainst services including OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.Juniper ScreenOSused the scripts against services including OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.Microsoft 365scanned websites for flaws using a tool containing more than 1,300 scripts, guessed passwords for Microsoft 365 and Exchange accounts, and copied mailboxes using tools designed to collect mail.Microsoft Exchange Serverfor flaws using a tool containing more than 1,300 scripts, guessed passwords for Microsoft 365 and Exchange accounts, and copied mailboxes using tools designed to collect mail.ONLYOFFICEMethod Invocation is turned on, and Apache says turning it off is an alternative to upgrading. The ONLYOFFICE flaw applies when JWT is used, according to its NVD record.OpenSSLto scan websites for specific flaws. The hackers have used the scripts against services including OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.Oracle WebLogic Serverfor specific flaws. The hackers have used the scripts against services including OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.Rejetto HFSflaws. The hackers have used the scripts against services including OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.SoftEtherTo keep access, the hackers install SoftEther, a legitimate VPN program that security software is less likely to flag, the advisory said. They often rename the installer conhost.exe or dllhost.exe so it looks like aStrapiStrapi's own advisory gives a wider range than the joint advisory. It says versions from 3.2.1 through 4.7.9, but not including 4.8.0, are affected.WordPresshackers have used the scripts against services including OpenSSL, Oracle WebLogic Server, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.
Tools
DC.exeTo take credentials, they ran a tool named DC.exe that uses DCSync, a technique that copies data from a domain controller through Active Directory's replication service. It copied account credentials, group membershipEBurstThe hackers also use password spraying, which means trying a few common passwords against many accounts. For this, they use EBurst, an open-source Python tool that targets Microsoft 365 and Exchange accounts.masscanThe hackers look for flaws in networks and web applications with open-source scanners such as Nmap, masscan, and WPScan, the advisory said. Their scans focus on ports 21, 22, 53, 80, 443, and 1080.MicroScanThe hackers have also used a scanner called MicroScan since as early as 2017. It is a Python web application containing more than 1,300 penetration testing scripts designed to scan websites for specific flaws. TheNmapThe hackers look for flaws in networks and web applications with open-source scanners such as Nmap, masscan, and WPScan, the advisory said. Their scans focus on ports 21, 22, 53, 80, 443, and 1080.office-cliA second tool, office-cli, keeps going back to Microsoft 365 accounts to take mail from different time periods. It works from configuration files that hold a client ID, tenant ID, and secret, and it avoids detection byWPScanThe hackers look for flaws in networks and web applications with open-source scanners such as Nmap, masscan, and WPScan, the advisory said. Their scans focus on ports 21, 22, 53, 80, 443, and 1080.
Countries
Industries
critical manufacturingThe same hackers targeted U.S. government services, critical manufacturing, healthcare, and IT organizations, along with U.S. law enforcement, education, and religious groups. Organizations in Southeast Asia, Africa,Educationservices, critical manufacturing, healthcare, and IT organizations, along with U.S. law enforcement, education, and religious groups. Organizations in Southeast Asia, Africa, and North America were also targeted.GovernmentHackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 otherHealthcareto a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries saidInformation TechnologyLaw enforcementHackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 otherReligious institutionsstole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8.