Fast Facts
- Chinese-linked group Integrity Technology Group uses open-source tools, exploit codes, and XSS vulnerabilities to initially breach networks.
- They maintain persistence via VPNs like SoftEther and exfiltrate data through staged files and specialized scripts targeting sensitive information.
- Their operations mainly target government, healthcare, and law enforcement entities in Southeast Asia, risking sensitive data leakage and system compromise.
Threat, Attack Techniques, and Targets
The Integrity Technology Group is a Chinese cyber organization linked to hacking activities backed by Beijing. This group has been involved in building cyber tools, hosting infrastructure, and hacking networks worldwide. They are associated with known hacking groups like Flax Typhoon, Ethereal Panda, and Red Juliett. The group uses several TTPs to conduct their attacks. They use open-source scanning tools and a hacking tool called “MicroScan” to find vulnerabilities. They also gain access using exploit codes written in Python and Go. Additionally, they compromise third-party applications through cross-site scripting (XSS) bugs. For password guessing, they use a tool named EBurst to spray passwords against Microsoft 365 accounts. To stay hidden and control compromised networks, they install VPN clients like SoftEther. Their data theft methods include staging files with different names and using a PHP script called Curlc4.txt to collect emails. They also steal Active Directory information with a tool called DC.exe and continuously access Outlook 365 accounts using “office-cli.” Their main targets include government, law enforcement, healthcare, and religious groups. Most of these targets are in Southeast Asia.
Impact, Security Implications, and Remediation Guidance
The activities of this group can cause serious harm. They can steal sensitive data, disrupt services, and compromise organizational security. The group’s methods, like exploiting vulnerabilities and stealing account information, can lead to data breaches. These breaches can result in loss of trust and legal issues for organizations. To protect themselves, organizations should disable services they do not use, fix web application input errors, and strengthen identity management. Using multi-factor authentication can prevent unauthorized access. It is also vital to monitor systems for unusual activity. If an organization suspects an attack, they should consult their security vendor or a cybersecurity authority for specific remediation steps. This helps ensure they follow the most effective security measures.
Continue Your Tech Journey
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
