Cybercriminals linked to the Chinese company Integrity Technology Group have been targeting the email systems of government agencies and hospitals since 2021. Ten agencies from seven countries, including the FBI and the Spanish intelligence service, have alerted organizations about their methods. According to the U.S. Department of Justice, this Beijing-based company exploited a botnet of more than 200,000 routers and cameras dismantled by the FBI in September 2024. Washington imposed sanctions on the company in January 2025, and London froze its assets in December. The FBI and nine partner agencies have reconstructed each step of the intrusions in a joint advisory. To empty entire email inboxes, these hackers use free tools and known vulnerabilities that have been around for years, before making the stolen messages available to third parties. For the ten signatory agencies, Integrity Technology Group is a for-profit company linked to the Chinese government. Its employees design intrusion tools for sale and hack networks around the world. Christopher Wray, then director of the FBI, stated in 2024 that the company's president publicly acknowledged years of intelligence collection "for the security agencies of the Chinese government." Integrity Technology Group responded in January 2025 that the U.S. accusations had no basis, in a statement to the Shanghai Stock Exchange relayed by the Associated Press. The FBI recovered an archive of stolen emails from government agencies, law enforcement, health systems, and religious institutions in Southeast Asia. Hackers sometimes reserved access to these data for only the IP addresses of Xiamen, in southeastern China. To extract emails, they run the PHP script Curlc4.txt. The emails are retrieved via Exchange Web Services, then compressed and sometimes encrypted before being sent to a remote server. Using the office-cli program, the hackers simultaneously access Microsoft 365 accounts using legitimate application credentials. According to the agencies, security teams see these connections as normal usage. The stolen data then circulates outside the company. The hackers maintain a web application open to third parties, with users adding some parameters to a URL address to read emails from a specific account. The agencies do not disclose their identities. The hackers identify their targets using open-source scanners freely available on GitHub, with Nmap and masscan leading. The agencies deduce a "tendency to seek more vulnerable targets." They also have access to MicroScan since at least 2017. More than 1,300 intrusion test scripts are collected in this Python application, ready to test WordPress or Apache Struts. The agencies list eight successfully exploited vulnerabilities. The oldest one, in GNU Bash, dates back to 2014. The most recent one, in the CMS Strapi, dates to 2023, and five of them have recently been added to the CISA catalog dedicated to vulnerabilities exploited during real attacks. The hackers also test some common passwords on many Exchange and Microsoft 365 accounts using the open-source tool EBurst. Once inside the network, they install the SoftEther VPN and often rename it to conhost.exe or dllhost.exe to make it appear as a Windows file. Security teams have little chance of detecting it, as SoftEther is a legitimate software. The agencies recommend requiring two-factor authentication on webmails and VPNs, and applying the fixes for the eight listed vulnerabilities. They finally provide 39 pages of indicators of compromise, with IP addresses and domain names sometimes up to ten years old, to check before any blocking. By cross-referencing this list, The Hacker News found ten IP addresses associated in 2024 with the command servers of the dismantled botnet. Their last activity dates do not agree across sources.