US Authorities Disrupt Major Chinese State-Sponsored Cyber Infrastructure Linked to Integrity Technology Group

The threat actors associated with Integrity Tech do not rely on a single method of entry. Instead, they employ a sophisticated and unique combination of tactics designed to maximize their reach while minimizing their visibility. One of the most effective components of their strategy is the use of large-scale botnets. By compromising thousands of consumer-grade devices—such as routers and IoT hardware—the group creates a massive, distributed network that can be used to launch attacks and relay traffic, making it extremely difficult for defenders to trace the activity back to its source.

In addition to botnets, the group makes extensive use of virtual private network (VPN) infrastructure and "living off the land" (LOTL) techniques. LOTL involves using legitimate system tools and administrative software already present on a victim’s network to carry out malicious actions. Because these tools are trusted by the operating system, their use often bypasses traditional antivirus and endpoint detection software. When combined with a repository of proprietary computer network exploitation (CNE) tools, this approach creates a formidable challenge for even the most well-equipped security teams.

The development and deployment of Microscan and FishHub fit perfectly into this tactical framework. Microscan, a Python-based web application, served as the group’s primary reconnaissance engine. It was not merely a simple scanner; it contained a library of over 1,300 penetration testing scripts. These scripts were meticulously written to probe websites and servers for specific, known vulnerabilities.

The scope of Microscan’s targeting was vast. The threat actors used the tool to hunt for weaknesses in a wide variety of services and platforms, including OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. By automating the search for these vulnerabilities, Integrity Tech could identify potential targets at an industrial scale, allowing their clients to strike whenever a high-value opportunity presented itself.

The victims of these scanning operations spanned the globe, illustrating the indiscriminate nature of the group’s reconnaissance. In the United States, targets included a power company based in South Carolina, raising serious concerns about the security of the nation’s energy grid. Beyond US borders, the group targeted a multi-national non-governmental organization (NGO), as well as critical transportation hubs like Japanese and Polish airports. In Taiwan, the focus was even more intense, with the group targeting critical infrastructure companies in the natural gas and power sectors, alongside two major universities.

Spear phishing campaign targeted corporate networks

While Microscan was used to find the "doors" into a network, the second tool, FishHub, was designed to walk through them. FishHub played a critical role in the exploitation phase of the group’s operations, often following an initial compromise achieved through spear phishing. These targeted email attacks would trick employees into clicking malicious links or downloading attachments, providing the initial foothold the attackers needed.

Once a network was compromised, FishHub would be deployed to download additional malware, effectively turning the initial breach into a permanent backdoor. This gave Integrity Tech’s clients unauthorized remote access to the victim’s environment, allowing them to move laterally through the network to find sensitive data. FishHub was also equipped with specialized search functions, enabling it to locate specific files and exfiltrate them to servers controlled by the group.