Integrity Technology Group: SafeBreach Coverage for CISA Alert AA26-281A

A joint cybersecurity advisory (AA26-281A) attributed to Chinese government-linked actors enabled by Integrity Technology Group describes a long-running campaign that pairs large-scale automated scanning and botnet infrastructure with hands-on exploitation to steal email and Active Directory credentials. The actors use MicroScan, commodity scanners, XSS, password spraying against Exchange, SoftEther VPN installers for persistence, DCSync (DC.exe) for credential access, and purpose-built email-exfiltration scripts; eight CVEs were confirmed exploited (five added to CISA KEV). The advisory provides extensive IOCs, MITRE ATT&CK mappings, mitigations (MFA, patching, hunting for SoftEther/DCSync, monitoring Exchange interfaces), and SafeBreach simulation coverage to validate defenses.