The Hacking Group With a Business License
Picture the word hacker and a certain image probably comes to mind: a hooded figure, alone, lit by a monitor at three in the morning. That image is comforting in a way, because it suggests hacking is marginal, rare, something done by outliers operating outside normal life. The reality behind a joint advisory published on October 8 by the FBI and cybersecurity agencies in six partner countries is less comforting. The threat actor named in that advisory, a company called Integrity Technology Group, has offices. It has a payroll. Its chairman has, according to past FBI statements, publicly acknowledged that his company collects intelligence and performs reconnaissance work for Chinese government security agencies. This is not freelance hacking. It is a vendor relationship, with Beijing as the client.
What the Joint Advisory Actually Says
According to the advisory, Integrity Technology Group has been breaking into networks since at least mid January 2021, targeting government organizations, law enforcement agencies, healthcare systems, and religious institutions across Southeast Asia. The targeting itself tells its own story. Religious institutions and healthcare systems are not typically where financially motivated criminals go looking for a payday. They are, however, exactly where an intelligence service goes looking for the kind of information that helps a government understand, monitor, or pressure populations and institutions it has an interest in.
The techniques described in the advisory are not exotic. Investigators describe a password spraying tool called EBurst used against Microsoft 365 and Exchange accounts, a tactic that simply tries a small number of common or leaked passwords across a huge number of accounts, betting correctly that at least a few employees somewhere are still reusing something predictable. For reconnaissance, the group used a mix of well known open source scanning tools alongside a custom built scanner called MicroScan, described as a Python based web application containing more than 1,300 penetration testing scripts. Once inside, mailbox collection was handled through a PHP based tool run against Exchange Web Services, and credential harvesting leaned on a domain controller replication technique known as DCSync, a method that abuses a legitimate Windows feature rather than exploiting a flaw in it.
None of that requires a previously unknown vulnerability or a dramatic zero-day. It requires patience, a long operational runway, and targets who have not gotten around to turning on multi-factor authentication everywhere it matters. That combination, unglamorous as it sounds, is apparently enough to run a multi year espionage campaign across an entire region.
This Is Not the First Time
Integrity Technology Group is not a new name to sanctions authorities. The United States Treasury sanctioned the company in January 2025, and the United Kingdom followed with its own sanctions in December of that same year. The FBI has previously quoted the company's own chairman acknowledging, in essentially plain language, that his company performs reconnaissance and intelligence collection work for Chinese government security agencies. A company getting sanctioned by two Western governments and having its own leadership publicly confirm the nature of its work would, in most industries, be a career ending event. In this one, it appears to have kept operating well into 2026, which says something uncomfortable about how durable this kind of state linked hacking for hire arrangement actually is once it is established.
Why a Private Company Doing This Matters More, Not Less
There is a reason nation states increasingly route this kind of operation through a nominally private company rather than running it directly out of a military or intelligence agency. A private company offers a layer of deniability. It can be sanctioned without the diplomatic weight of sanctioning a government ministry directly. Its individual employees can plausibly claim, at least to themselves, that they are doing contract IT and security work rather than state espionage, even when their own chairman has said otherwise in public. And critically, a private company can sell its access and its tools to more than one client, which means the line between state directed espionage and freelance cybercrime for hire gets blurrier every year.
For organizations in the targeted sectors, government, law enforcement, healthcare, and religious or nonprofit institutions, this advisory is a direct warning that the threat you are defending against may not be a criminal looking for a quick payday at all. It may be a well funded, multi year, institutionally backed campaign with no interest in a ransom payment and every interest in staying inside your network undetected for as long as possible. Those two threat models call for genuinely different defenses. A criminal wants to get in, get something valuable, and get out fast. An intelligence focused actor wants to get in and stay, quietly, for years.
What Organizations in the Crosshairs Should Actually Do
Multi-factor authentication on every account that touches email or file access is the single highest leverage defense against the exact techniques described in this advisory, since password spraying and credential stuffing simply stop working once a second factor is required. Beyond that, treat mailbox access logs as something worth actually reviewing rather than something that accumulates silently, since bulk mailbox collection through Exchange Web Services tends to leave an access pattern that looks nothing like normal human behavior once someone actually looks for it.
Organizations in government, healthcare, law enforcement, or religious and nonprofit sectors operating anywhere in Southeast Asia, or anywhere with ties to the region, should treat this advisory as a direct, named warning rather than background noise from a part of the world that feels far away. State linked threat actors do not announce when they move on to a new target list, and a company already sanctioned twice by two different governments while continuing to operate has made its intentions about as clear as this category of threat actor ever does.
At AetherGuard Technologies, we help organizations build defenses against exactly this kind of patient, credential focused intrusion, the kind that does not announce itself with a ransom note because it was never trying to get caught in the first place.
