[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3EKjxMGRpXBGqYCedMq_dIRNh5nPXTfNAg8Ch3J-raI":3},{"article":4,"iocs":55,"watch_terms":66,"solutions":67,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4628ea24-e2b1-4a3b-9926-da34a064e279","FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails","fbi-says-china-linked-hackers-ran-portal-giving-third-parties-access-to-stolen-e-92f369","Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8. The company, Integrity Technology Group, has been sanctioned by the U.S. and the UK. The hackers scanned websites for flaws using a tool containing more","Hackers associated with the China-based Integrity Technology Group have been stealing emails from government, law enforcement, healthcare, and religious organizations across Southeast Asia, Africa, and North America since at least January 2021. The group also operated a portal to provide third-party access to the stolen data. The U.S. and UK have sanctioned Integrity Technology Group, and the FBI disrupted a botnet controlled by the company in 2024.","China-linked hackers stole emails and provided third-party access via a portal.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Ffbi-says-china-linked-hackers-ran.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhyj_ek8VTEYw5CpVqkAK63I01D84oGBvRsHmwpjeAfat3TCDqzhXqRWXWCGkNZKwH3rF0uyeuowCSGcBT-mLkdw-174FA0gGh8ZIVKOXUbXt9w0eTZZTlMGE-ySkZIIkswfxe0-cEU9ww6E8iIpWI2eDQU_NrsezDxIoE2WNBt8mDtG6nYeke9Ut17_JY\u002Fs1600\u002Fchina-email.jpg","2026-10-08T18:32:21+00:00","2026-10-08T20:00:10.507458+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Flax Typhoon","threat_actor",{"name":21,"type":19},"Ethereal Panda",{"name":23,"type":19},"RedJuliett",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":29},"Microsoft 365","product",{"name":31,"type":26},"Integrity Technology Group","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63],{"type":57,"value":58,"context":59},"mitre_attack","T1071","Use of open source scanners like Nmap, masscan, and WPScan for network scanning",{"type":57,"value":61,"context":62},"T1110","Password guessing for Microsoft 365 and Exchange accounts",{"type":57,"value":64,"context":65},"T1041","Copying mailboxes using tools designed to collect mail",[25,31,28],{"controls":68,"vendors":152},[69,97,123],{"slug":70,"name":71,"problem":72,"products":73},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[74,81,89],{"vendor_slug":75,"vendor_name":25,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":98,"name":99,"problem":100,"products":101},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[102,107,115],{"vendor_slug":75,"vendor_name":25,"vendor_logo":76,"product_slug":103,"product_name":104,"url":105,"description":106},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":124,"name":125,"problem":126,"products":127},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[153],{"slug":75,"name":25,"logo_path":76,"roles":154},[155],"affected",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":176},"china-linked-hackers-built-commercial-portal-to-resell-stolen-government-emails","China-Linked Hackers Built Commercial Portal to Resell Stolen Government Emails","The Integrity Technology Group conducted a years-long campaign stealing emails from high-value targets including government, law enforcement, and healthcare organizations, operating at least since January 2021 before detection. Most critically, the threat actors commoditized the stolen data by building a portal that granted paying third parties direct access to the exfiltrated communications, dramatically amplifying the harm beyond the initial breach. This case illustrates how insufficient email security controls, poor visibility into abnormal data exfiltration patterns, and delayed detection allowed a sophisticated actor to operate unimpeded for years. The existence of a commercial resale portal means downstream victims may be exposed to threats from multiple actors, not just the original attacker, compounding the long-term risk to affected organizations.",[161,162,163,164,165,166,167,168,169,170,171,172,173,174,175],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4 – System Monitoring","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF PR.DS-5 – Protections Against Data Leaks","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","MITRE ATT&CK T1114 – Email Collection","MITRE ATT&CK T1567 – Exfiltration Over Web Service","ITIL – Information Security Management (Incident and Access Controls)",{"CIS Control 3 – Data Protection":177,"CIS Control 8 – Audit Log Management":178,"NIST SP 800-53 AC-17 – Remote Access":179,"MITRE ATT&CK T1114 – Email Collection":180,"NIST CSF DE.CM-1 – Network Monitoring":181,"NIST SP 800-53 SI-4 – System Monitoring":182,"GDPR Article 32 – Security of Processing":183,"NIST SP 800-53 AC-2 – Account Management":184,"CIS Control 6 – Access Control Management":185,"CIS Control 13 – Network Monitoring and Defense":186,"NIST CSF PR.DS-5 – Protections Against Data Leaks":187,"MITRE ATT&CK T1567 – Exfiltration Over Web Service":188,"GDPR Article 33 – Notification of Personal Data Breach":189,"NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting":190,"ITIL – Information Security Management (Incident and Access Controls)":191},"Data protection, including encryption of sensitive email, reduces the value of stolen messages.","Audit logs of mailbox access help detect years-long email collection by attackers.","Remote access controls limit attackers' ability to access email from outside the organisation.","Email collection is the core technique here, so monitoring mailbox access is key.","Network monitoring helps detect exfiltration of email data to external services.","System monitoring helps detect long-running espionage campaigns targeting email.","Security of processing requires protection for email systems containing personal data.","Account management with monitoring for unusual mailbox access helps detect compromise.","Access control management limits who can access mailboxes, making long-term email theft harder.","Network monitoring can detect unusual data flows from email systems to external portals.","Protections against data leaks help detect and block bulk email exfiltration.","Exfiltration over web services matches how stolen emails were moved to the attackers' portal.","A breach of government email triggers notification duties where personal data is involved.","Reviewing audit records helps detect persistent unauthorised email access.","Information security management covers access control and incident handling for email systems."]