(TLP:CLEAR) Joint Advisory Exposes China-Linked Integrity Tech’s Tools and Tactics for Stealing Sensitive Data

Summary: The FBI, CISA, and NSA, with partner agencies from six other countries, recently released a joint Cybersecurity Advisory on threat actors being enabled by a China-based company called Integrity Technology Group (Integrity Tech) with links to the Chinese government. The activity overlaps with groups tracked as Flax Typhoon, Ethereal Panda, and Red Juliett and has targeted U.S. government, critical manufacturing, healthcare, and IT organizations.

The actors combine automated scanning, including a proprietary tool called MicroScan, with hands-on exploitation of known vulnerabilities, some dating to 2014. They harvest credentials through cross-site scripting (XSS) and password spraying against Microsoft Exchange. They maintain persistent access by installing the legitimate SoftEther virtual private network (VPN) client disguised as Windows processes, then steal email. In a coordinated action, the FBI seized seven domains used to operate MicroScan and FishHub, a spear-phishing tool.

Analyst Note: Water and wastewater systems are not named in the advisory, but these actors scan broadly for weak, internet-facing systems. Utilities running aging VPN appliances, FTP servers, or self-hosted web applications fit that profile. Credentials stolen from IT systems can also become a path toward OT environments where segmentation is weak. The persistence techniques rely on legitimate software that rarely triggers alerts. WaterISAC suggests members:

• Check internet-facing systems for the CVEs listed in Appendix B and replace unsupported appliances.
• Require phishing-resistant multifactor authentication (MFA) for webmail and remote access.
• Hunt for unapproved VPN clients, and for ‘conhost[.]exe’ or ‘dllhost[.]exe’ running outside System32.
• Monitor for unexpected Active Directory replication requests from hosts that are not domain controllers.

WaterISAC encourages members to load the advisory’s IOCs into detection tools, review historical logs for matches, and report any findings to WaterISAC. Some IOCs date to 2016, so vet them before blocking.

Original Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a

Additional Reading:

• FBI Disrupts Chinese Hacking Tools Used to Breach Critical Infrastructure
• Identifying and Mitigating Living Off the Land Techniques
• People’s Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations

Related WaterISAC PIRs: 6, 7, 7.1, 8, 11, 12