Integrity Technology Group Tied to Exchange, VPN Attacks on Critical Infrastructure

En bref

• Chinese government-linked actors, including Integrity Technology Group, are behind the campaign.
• Targets include Microsoft Exchange and VPN software, with no CVE assigned.
• Attackers use automated scanning, botnets, password spraying, and cross-site scripting.
• Impact includes credential theft, email exfiltration, and sensitive data theft.
• Critical infrastructure in the US and organizations worldwide are at risk.

On October 8, 2026, reports emerged that Chinese government-linked actors, specifically a group known as Integrity Technology Group, are conducting a broad campaign against Microsoft Exchange and VPN software. The operation has no assigned CVEs, suggesting exploitation of known flaws or misconfigurations rather than a single new vulnerability. The group targets organizations globally, with a particular focus on critical infrastructure sectors within the United States.

The attackers employ a mix of automated and hands-on techniques. They use automated scanning to identify vulnerable systems, leverage botnets for scale, and perform password spraying to guess credentials. Cross-site scripting is used to compromise web interfaces, while VPN persistence allows them to maintain long-term access. Script-based exfiltration enables stealthy theft of email and other sensitive data.

The impact is severe: credential theft, email exfiltration, and sensitive data theft. Critical infrastructure targeting raises concerns about disruption to essential services. The campaign's worldwide scope means any organization using Microsoft Exchange or VPN software could be at risk, though American critical infrastructure sectors are explicitly named.

Microsoft has likely issued mitigation recommendations, but no specific CVE is cited. IT administrators should prioritize patching, enforce multi-factor authentication, and monitor for unusual VPN activity. The use of botnets and automated scanning indicates a high-volume, persistent threat that requires immediate defensive action.

Watch for updates from Microsoft and government advisories. The absence of a CVE may complicate tracking, so focus on behavioral detection and hardening exposed services. This campaign underscores the need for robust identity and access management, especially for remote access systems.

À faire maintenant

1. Immediately patch and update Microsoft Exchange and all VPN software to the latest versions.
2. Enforce multi-factor authentication (MFA) on all remote access and email accounts.
3. Monitor VPN logs for anomalous persistence and unusual login patterns.
4. Deploy endpoint detection and response (EDR) to catch script-based exfiltration and cross-site scripting attempts.
5. Conduct password spraying simulations and enforce strong password policies.
6. Segment critical infrastructure networks and limit lateral movement.
7. Review Microsoft and government mitigation recommendations and apply them urgently.

Source originale

CISA Advisories