FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails

A joint advisory links a China-based company, Integrity Technology Group, and affiliated hackers to a long-running campaign (since at least January 2021) that exfiltrated email and credentials from government, law enforcement, healthcare, religious, and other organizations across Southeast Asia and beyond. The actors used large-scale automated scanning (including a MicroScan tool with 1,300+ scripts), exploited multiple known CVEs, performed password-spraying against Microsoft 365/Exchange (using EBurst), deployed malware (e.g., live700_v1.exe, SoftEther persistence), used DCSync to extract AD credentials, and operated a 200k+ device botnet; the advisory includes 39 pages of IOCs and prescriptive defensive actions.