[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fE7hnysCVcAGpKQyAHeTDHSFIVr4Cp8CleeV2xDNUmKg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":43,"created_at":44,"published_at":45,"article":46,"tags":50,"podcasts":69,"controls":70},"d9505131-1e22-4336-9c26-21806cc527ad","china-linked-hackers-built-commercial-portal-to-resell-stolen-government-emails","4628ea24-e2b1-4a3b-9926-da34a064e279","China-Linked Hackers Built Commercial Portal to Resell Stolen Government Emails","The Integrity Technology Group conducted a years-long campaign stealing emails from high-value targets including government, law enforcement, and healthcare organizations, operating at least since January 2021 before detection. Most critically, the threat actors commoditized the stolen data by building a portal that granted paying third parties direct access to the exfiltrated communications, dramatically amplifying the harm beyond the initial breach. This case illustrates how insufficient email security controls, poor visibility into abnormal data exfiltration patterns, and delayed detection allowed a sophisticated actor to operate unimpeded for years. The existence of a commercial resale portal means downstream victims may be exposed to threats from multiple actors, not just the original attacker, compounding the long-term risk to affected organizations.","**Immediate actions:**\n- Audit and enforce multi-factor authentication (MFA) on all email platforms, especially internet-facing access points like OWA or webmail portals.\n- Conduct a threat hunt across email gateway logs for signs of large-scale, anomalous data exfiltration consistent with bulk email harvesting.\n- Review and restrict third-party and delegated access permissions within your email environment (e.g., Exchange delegate access, OAuth app permissions).\n\n**Detection measures:**\n- Deploy User and Entity Behavior Analytics (UEBA) to flag abnormal email access patterns such as mass downloads, forwarding rules, or access from unusual geolocations.\n- Implement Data Loss Prevention (DLP) rules specifically targeting bulk email exfiltration attempts via SMTP, HTTPS, or API channels.\n- Enable comprehensive audit logging for all email access events and ensure logs are retained for a minimum of 12 months in a tamper-resistant SIEM.\n\n**Long-term improvements:**\n- Adopt a Zero Trust architecture that continuously validates identity and device posture before granting access to sensitive communications infrastructure.\n- Establish formal threat intelligence sharing partnerships (e.g., ISACs) to receive early warning of nation-state targeting campaigns relevant to your sector.\n- Conduct regular purple team exercises simulating email exfiltration scenarios to validate detection and response capabilities against advanced persistent threats.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4 – System Monitoring","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF PR.DS-5 – Protections Against Data Leaks","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","MITRE ATT&CK T1114 – Email Collection","MITRE ATT&CK T1567 – Exfiltration Over Web Service","ITIL – Information Security Management (Incident and Access Controls)",{"CIS Control 3 – Data Protection":28,"CIS Control 8 – Audit Log Management":29,"NIST SP 800-53 AC-17 – Remote Access":30,"MITRE ATT&CK T1114 – Email Collection":31,"NIST CSF DE.CM-1 – Network Monitoring":32,"NIST SP 800-53 SI-4 – System Monitoring":33,"GDPR Article 32 – Security of Processing":34,"NIST SP 800-53 AC-2 – Account Management":35,"CIS Control 6 – Access Control Management":36,"CIS Control 13 – Network Monitoring and Defense":37,"NIST CSF PR.DS-5 – Protections Against Data Leaks":38,"MITRE ATT&CK T1567 – Exfiltration Over Web Service":39,"GDPR Article 33 – Notification of Personal Data Breach":40,"NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting":41,"ITIL – Information Security Management (Incident and Access Controls)":42},"Data protection, including encryption of sensitive email, reduces the value of stolen messages.","Audit logs of mailbox access help detect years-long email collection by attackers.","Remote access controls limit attackers' ability to access email from outside the organisation.","Email collection is the core technique here, so monitoring mailbox access is key.","Network monitoring helps detect exfiltration of email data to external services.","System monitoring helps detect long-running espionage campaigns targeting email.","Security of processing requires protection for email systems containing personal data.","Account management with monitoring for unusual mailbox access helps detect compromise.","Access control management limits who can access mailboxes, making long-term email theft harder.","Network monitoring can detect unusual data flows from email systems to external portals.","Protections against data leaks help detect and block bulk email exfiltration.","Exfiltration over web services matches how stolen emails were moved to the attackers' portal.","A breach of government email triggers notification duties where personal data is involved.","Reviewing audit records helps detect persistent unauthorised email access.","Information security management covers access control and incident handling for email systems.","published","2026-10-08T20:21:18.541327+00:00","2026-10-08T20:21:18.219+00:00",{"id":7,"url":47,"slug":48,"title":49},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Ffbi-says-china-linked-hackers-ran.html","fbi-says-china-linked-hackers-ran-portal-giving-third-parties-access-to-stolen-e-92f369","FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails",[51,57,63],{"id":52,"name":53,"slug":54,"description":55,"color":56},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":58,"name":59,"slug":60,"description":61,"color":62},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":64,"name":65,"slug":66,"description":67,"color":68},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[71,75,79],{"slug":72,"name":73,"problem":74},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":76,"name":77,"problem":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":80,"name":81,"problem":82},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]