US and Allies Detail TTPs of Sanctioned Chinese Hacking Firm

Executive Summary

A coalition of cybersecurity agencies from the U.S., U.K., and other allied nations has published a detailed joint advisory on Integrity Technology Group (ITG), a China-based company sanctioned for its role in global cyber espionage. The advisory, released on October 8, 2026, dissects ITG's function as a for-profit hacking contractor, developing and deploying cyber capabilities on behalf of Chinese state-sponsored threat actors, including the group known as Flax Typhoon (aka Ethereal Panda). The U.S. Department of Justice also announced the seizure of domains and hacking tools used by ITG, providing a rare public look into the commercial supply chain supporting China's state hacking operations.

Threat Overview

The advisory provides a clear picture of the public-private partnership model used by China for its cyber operations. ITG acts as a 'hacker-for-hire' entity, providing the tools, infrastructure, and operational support for state-directed campaigns. Their targets are widespread and align with China's strategic interests, including critical infrastructure, government, healthcare, and manufacturing sectors across North America, Southeast Asia, and Africa.

The group's activities mimic those previously attributed to Flax Typhoon, a threat actor known for targeting entities in Taiwan and other regions. The U.S. government's seizure of ITG's tools, including FishHub and MicroScan, represents a direct disruption of their operations.

Technical Analysis

ITG employs a mix of open-source and custom-built tools to conduct its operations. Their methodology is systematic, beginning with broad scanning and progressing to targeted exploitation.

Tools and TTPs:

• Scanning: ITG uses open-source tools and a custom utility called MicroScan, which contains over 1,300 penetration testing scripts, to scan networks for specific vulnerabilities.
• Exploitation: The group has been observed exploiting cross-site scripting (XSS) vulnerabilities to gain initial access.
• Credential Access: A tool named EBurst is used to conduct password spraying attacks against Microsoft 365 accounts.
• Collection: After gaining access to email accounts, the attackers use a command-line utility called office-cli to target Outlook 365 and exfiltrate emails.

MITRE ATT&CK Techniques

• T1595.002 - Vulnerability Scanning: The use of MicroScan and other tools to actively scan for weaknesses is a key part of their reconnaissance phase.
• T1190 - Exploit Public-Facing Application: The advisory mentions the exploitation of vulnerabilities like XSS in web applications.
• T1110.003 - Password Spraying: The tool EBurst is explicitly used for password spraying against Microsoft 365, a common technique to compromise accounts with weak passwords.
• T1114.002 - Remote Email Collection: The use of the office-cli tool to steal emails from compromised Outlook 365 accounts falls under this technique.
• T1588.002 - Tool: As a contractor, ITG's entire purpose is to 'Obtain Capabilities' by developing and acquiring tools like FishHub and MicroScan for use in attacks.

Impact Assessment

The activities of ITG and Flax Typhoon pose a significant threat to global critical infrastructure and government entities. The targets listed—including a power company in South Carolina, a Polish airport, and Taiwanese gas and power companies—demonstrate a clear focus on sectors with strategic importance. A successful compromise of these entities could lead to operational disruptions, espionage, or pre-positioning for future disruptive attacks. The joint advisory and DOJ action represent a coordinated effort by Western governments to expose and disrupt this state-sponsored commercial hacking ecosystem.

IOCs — Directly from Articles

The articles mention the names of tools but do not provide specific file hashes, domains, or IPs.

• Tools: FishHub, MicroScan, EBurst, office-cli

Cyber Observables — Hunting Hints

Security teams can hunt for TTPs associated with ITG and Flax Typhoon:

Detection & Response

• Monitor M365 Logs: Closely monitor Microsoft 365 audit logs for signs of password spraying, impossible travel alerts, and anomalous mailbox access rules being created. This aligns with D3FEND Domain Account Monitoring (D3-DAM).
• Endpoint Detection: Use an EDR solution to detect the execution of suspicious command-line utilities or PowerShell scripts used for email collection, such as office-cli.
• Web Application Firewall (WAF): Implement a WAF to detect and block attempts to exploit web vulnerabilities like XSS.

Mitigation

• Multi-Factor Authentication (MFA): Enforce phishing-resistant MFA on all user accounts, especially for cloud services like Microsoft 365. This is the most effective defense against password spraying attacks.
• Patch Management: Aggressively patch public-facing applications to prevent exploitation of known vulnerabilities. This is a fundamental aspect of D3FEND Software Update (D3-SU).
• Block Legacy Authentication: Disable legacy authentication protocols (e.g., POP, IMAP, SMTP AUTH) in Microsoft 365, as these protocols do not support MFA and are frequently abused in password spraying campaigns.
• Threat Intelligence Integration: Integrate threat intelligence feeds from government advisories (like this one) into security tools to automatically block known malicious indicators and detect TTPs associated with actors like Flax Typhoon.