CISA advisory links Flax Typhoon-style actors to Integrity Tech, detailing XSS, SoftEther persistence and mass email theft in Southeast Asia

Linha do tempo

1. cisa.gov ↗ · pub. 06/10/2026 13:22 · coletado 19/10 18:37 primeiro registro

   CISA advisory links Flax Typhoon-style actors to Integrity Tech, detailing XSS, SoftEther persistence and mass email theft in Southeast Asia

   ler a análise desta fonte ocultar

   A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Panda and Red Juliett, though the advisory notes that vendor tracking does not map 1:1 to US Government attribution. Operations combine automated open source scanning with hands-on exploitation, persistence through legitimate VPN software and large-scale email theft. Observed email theft victims included government, law enforcement, healthcare and religious organizations in Southeast Asia.

   Technical Details

   • Reconnaissance: open source scanners (BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, wpscan) [T1595.002] focused on ports 21, 22, 53, 80, 443 and 1080. The actors have used the Python web app MicroScan (1,300+ scripts) since 2017, targeting OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins and Apache Struts.
   • Initial access: exploit-based command line utilities in Python and Go [T1059.006], plus JavaScript/HTML XSS [T1059.007, T1189]. A recovered XSS payload shows a fake login form for credential harvesting, then delivers a password-protected .zip containing live700_v1.exe. That binary launches DiagTrack.exe [T1036.003], which beacons over encrypted HTTP to dns.studiocloud.xyz (attributed by the FBI to Integrity Tech) and can query user mailboxes.
   • Credential attacks: EBurst performs password spraying and guessing [T1110.003, T1110.001] against Exchange/Office365 interfaces (ECP, EWS, OAB, OWA, RPC, API, MAPI, ActiveSync).
   • Persistence: SoftEther VPN clients [T1133] downloaded via PowerShell/LOTL binaries or curl/wget [T1059.001], renamed conhost.exe or dllhost.exe, and set to auto-reconnect.
   • Collection and exfiltration: the PHP bot Curlc4.txt abuses the Microsoft EWS API [T1114.002], stages data in writable directories [T1074.001], compresses and encrypts it with RC4 or AES-128-CBC [T1560.003], and uploads it [T1020] to natcloudservice[.]com (upl.natcloudservice[.]com, 149.28.132[.]137). DC.exe performs DCSync [T1003.006]. The Linux binary office-cli [T1059.004] automates continuous Outlook 365 mail theft using client_id, tenant_id and secret configuration files. A custom web application gives third parties access to the stolen email, and in some cases access to exfiltrated data was restricted to IP addresses in Xiamen, China.

   Remediation

   • If compromise is suspected, isolate affected hosts, hunt to scope the intrusion, and use CISA's Eviction Strategies Tool (Playbook-NG and COUN7ER).
   • Require MFA for all services, especially webmail and VPNs.
   • Sanitize user input in web applications to block XSS.
   • Disable unused services and ports, and reduce internet exposure.
   • Monitor for LOTL tool abuse and unexpected Active Directory replication.
   • Review cloud accounts for connected applications that can access email.
   • Review web application logs for exploitation and enumeration attempts.
   • Segment networks and apply least privilege.
   • Monitor for high outbound upload volumes and abnormal account logons.
   • Enable domain reputation screening and protective DNS.
   • Apply patches promptly.