Chinese State Hackers Target Critical Infrastructure in Global Data Theft

This intelligence report attributes a widespread cyber-espionage campaign to Chinese state-sponsored actors (linked to a company named Integrity Technology Group) that use automated scanning tools, web-based credential harvesting, password-guessing against Exchange, and SoftEther VPN for persistence; they deploy custom PHP bots to copy and exfiltrate email data and use Active Directory abuse (DCSync) to harvest sensitive configuration and credentials, impacting government, healthcare, manufacturing, and other sectors worldwide.