China-Linked Threat Actors Combine Automated and Hands-On Hacking to Steal Sensitive Data

China-Linked Threat Actors Combine Automated and Hands-On Hacking to Steal Sensitive Data

A joint advisory from CISA, the FBI, NSA, and international partners warns that China-linked cyber threat actors enabled by Integrity Technology Group are combining large-scale automated scanning with hands-on exploitation to target organizations worldwide, including U.S. critical infrastructure.

Who Is Behind the Activity

The activity is linked to Integrity Technology Group, a China-based for-profit company with ties to the Chinese government. The threat actors it enables use tactics consistent with publicly tracked groups including Flax Typhoon, Ethereal Panda, and Red Juliett. They employ a mix of large-scale botnets, VPN infrastructure, living-off-the-land (LOTL) techniques, and repositories of custom exploitation tools to compromise networks and steal sensitive data.

Reconnaissance and Initial Access

The actors rely heavily on open-source scanning tools to find vulnerable systems and web applications. Tools observed include BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and wpscan. They typically focus on common ports (21, 22, 53, 80, 443, 1080) and, when scanning websites, enumerate PHP and ASP.NET pages.

One notable tool in their arsenal is MicroScan, a Python-based web application containing over 1,300 penetration testing scripts. These scripts are used to test for vulnerabilities in services such as OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. The advisory lists multiple CVEs successfully exploited via these scripts, including CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, and CVE-2023-22894.

Initial access has been achieved through custom command-line utilities (written in Python and Go), JavaScript, and HTML-based cross-site scripting (XSS) attacks. In observed XSS cases, a malicious payload modified a vulnerable webpage to present fake login fields, harvesting entered credentials and delivering a malware payload (live700_v1.exe). The payload established a process masquerading as DiagTrack.exe and communicated with actor-controlled infrastructure.

Credential Access and Persistence

To target Microsoft Exchange and Microsoft 365 environments, the actors use EBurst, an open-source Python tool that performs password spraying and password guessing against multiple Exchange interfaces (including ECP, EWS, OWA, RPC, MAPI, PowerShell, Autodiscover, and ActiveSync).

For persistence, the actors install SoftEther VPN client software on compromised devices, often renamed to appear as common Windows executables like conhost.exe or dllhost.exe. The VPN tunnels help obfuscate command and control traffic and maintain long-term access. SoftEther installers are typically downloaded via PowerShell, LOTL binaries, curl, or wget depending on the operating system.

Collection and Exfiltration

The threat actors focus heavily on email theft. One observed PHP script, Curlc4.txt, interfaces with the Microsoft EWS API to access mailboxes, compresses messages, optionally encrypts them (RC4 or AES-128-CBC), and uploads them to actor-controlled servers. The script stages data in discreetly named files to avoid detection.

They also use DC.exe to execute DCSync, replicating sensitive data from Active Directory—including account credentials, group memberships, and trust relationships. Another utility, office-cli, automates continuous access to Microsoft Outlook 365 mailboxes using stored configuration files and exfiltrates messages over time.

Stolen email content has been made accessible through a custom web application controlled by the actors, with some exfiltrated datasets reportedly restricted to IP addresses geolocated to Xiamen, China.

Targeting Scope

Victims span multiple U.S. critical infrastructure sectors, including Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. The actors have also targeted law enforcement, education, religious organizations, and entities across Southeast Asia, Africa, and North America.

Recommended Mitigations

CISA and its partners urge organizations to harden their environments against this activity. Key actions include:

• Disable unused services and ports (especially automatic configuration, remote access, and file sharing), and limit exposed services.
• Sanitize user input in web applications to prevent XSS and injection attacks.
• Enforce strong identity controls: Implement MFA across services (especially webmail, VPNs, and privileged accounts), replace defaults with strong passwords, and follow least privilege.
• Patch aggressively: Apply timely updates to address the listed CVEs and other known vulnerabilities.
• Harden detection: Monitor for LOTL tool use, unusual AD replication (DCSync), abnormal outbound traffic volumes, suspicious account activity, and unauthorized VPN installations.
• Segment and back up: Use network segmentation, maintain offline/segregated backups, and test recovery procedures.

Key Takeaway

This campaign demonstrates how China-linked actors blend automated scale with hands-on tradecraft. The use of widely available open-source tools alongside custom malware, combined with credential abuse and stealthy persistence, makes early detection and strong basic hygiene critical for defenders.

Sources

• CISA: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (AA26-281A)