The hackers did not just steal the email. According to a new US-led advisory, they also ran a web application that gave third parties access to it.
The FBI and agencies from six other countries published the advisory on 8 October. It ties the email theft to hackers linked to Integrity Technology Group, a Chinese cybersecurity company that the United States and the United Kingdom have already sanctioned, as reported by The Hacker News.
What the advisory says was taken
The FBI says it recovered an archived email database the attackers used to target accounts at victim organisations. According to the advisory, the group collected account credentials and pulled email data from both on-premise systems and cloud services.
Confirmed victims of email theft in Southeast Asia included government bodies, law enforcement agencies, healthcare systems and religious institutions. In some cases, the advisory says, access to the stolen data was limited to IP addresses in Xiamen, China.
The same hackers also went after other targets, The Hacker News reports. These included US government services, critical manufacturing, healthcare and IT organisations, as well as US law enforcement, education and religious groups. Organisations in Africa and North America were also targeted.
The advisory says the web application “provides third-party access to stolen email content”. It does not say who those third parties are. That gap matters. Public reporting so far does not show whether they were customers, partners or other state-linked groups.
Who the agencies blame
The agencies describe Integrity Technology Group as a China-based, for-profit company with links to the Chinese government. They say its employees build or acquire cyber tools for use and sale, host attack infrastructure and break into networks.
The advisory uses one label, “the threat actors”, for the company and the hackers it enables. It does not say which people or teams carried out each intrusion.
The methods are consistent with activity that security firms track under names such as Flax Typhoon, Ethereal Panda and RedJuliett, according to the advisory. The Hacker News notes those labels may not map neatly onto the US government’s own tracking. The same hackers may also do work unrelated to the company.
Integrity Technology Group rejected the US accusations in January 2025. It told the Shanghai Stock Exchange then that the American action had no factual basis, as the Associated Press reported. A Chinese Foreign Ministry spokesperson said China firmly opposed the US sanctions. Neither response is a reply to this latest advisory.
The advisory builds on a 2024 US action against a botnet. This document focuses on how the group gets into networks and what it takes, drawing on evidence from several FBI investigations.
Why email is such a prize
Email holds more than messages. It holds password reset links, contracts, medical correspondence, internal chatter and the contact lists that make follow-up attacks easier. An intruder with a mailbox can often move on to other accounts, or quietly watch for months.
The reported detail about a portal for outside access suggests stolen mail may have been treated as a product that could be shared. The advisory does not describe pricing or any commercial arrangement, and this article cannot confirm one.
What organisations and individuals can do
The advisory is aimed mainly at network defenders, and the full document on the FBI’s Internet Crime Complaint Center site lists technical indicators. Even so, several basic steps apply broadly. They are general good practice, not quotes from the advisory.
- Read the advisory. IT teams should check its indicators against their own logs, especially for unusual mailbox access and logins from unexpected locations.
- Patch internet-facing systems. Mail servers, VPNs and remote access tools are common entry points. Install vendor updates quickly.
- Use phishing-resistant sign-in. Passkeys or hardware security keys are harder to steal than passwords or text-message codes.
- Review mailbox rules and forwarding. Attackers often set up hidden forwarding. Check your settings for rules you did not create.
- Check connected apps. Remove third-party apps that have access to your mailbox and that you no longer use.
- Keep sensitive material out of the inbox. Delete old messages holding identity documents, passwords or financial records, or move them to encrypted storage.
- Watch your login history. Most major email providers show recent sign-ins and devices. Sign out of any you do not recognise and change the password.
What is still unclear
The advisory does not name individual victims, and it does not say how many mailboxes were taken. It also does not say how long the portal operated or who used it. Those answers may emerge from later investigations.
Separate US actions against China-linked individuals were announced around the same time. A report on one such reward notice says the available reporting does not show that it is part of the same campaign, group or period. Treat the two as distinct unless the agencies say otherwise.
For ordinary users, the practical message is modest but real. If a mailbox can be copied from a hospital or a police department, a personal account with a reused password is an easier target still.