Seven Domains Seized, Seven Governments Signed
On 8 October the FBI announced the seizure of seven web domains tied to hacking tools that US court documents allege were run by Integrity Technology Group, a China-based company the agencies say has links to the Chinese government. Alongside it, agencies in seven countries published one advisory, numbered AA26-281A.
The authors are the FBI, CISA and the NSA in the US, the UK's NCSC, Australia's ACSC, Canada's Cyber Centre, Japan's National Police Agency and National Cybersecurity Office, New Zealand's NCSC and Spain's CNI. They say actors enabled by Integrity Tech combine automated scanning, large botnets and hands-on exploitation to steal data, and that the activity matches what is publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett. The NCSC adds that the UK government sanctioned Integrity Tech last year.
Court documents allege that Integrity Tech built a Mirai-variant botnet and the Microscan vulnerability scanner, operated a tool called FishHub and has contracts with the Chinese government. They also say a database server held records for more than 1.2 million infected devices as of 5 June 2024, including over 385,000 in the US.
The Oldest Bug On The List Is From 2014
Eight CVEs appear in the advisory as successfully exploited, and four of them carry a 2014, 2015 or 2016 number.
| CVE | Product | Flaw | Newly added to CISA's catalogue |
|---|---|---|---|
| CVE-2014-6278 | GNU Bash | Remote code execution | No |
| CVE-2015-3306 | ProFTPD 1.3.5 | Unauthorized read | Yes |
| CVE-2015-5477 | ISC BIND 9.x | Denial of service | Yes |
| CVE-2016-3081 | Apache Struts 2.3 series | Remote code execution | Yes |
| CVE-2019-11510 | Pulse Connect Secure | Unauthorized read | No |
| CVE-2021-22205 | GitLab | Remote code execution | No |
| CVE-2021-3199 | ONLYOFFICE DocumentServer | Unauthorized write | Yes |
| CVE-2023-22894 | Strapi | Information disclosure | Yes |
The advisory says these CVEs were recovered from the scanner's penetration-testing scripts and were successfully exploited. Nothing in the list needs a new exploit. It needs software nobody patched, reachable from the internet, and Microscan, in use since as early as 2017, carries more than 1,300 scripts of that kind.
How The Actors Get In And Stay
The advisory describes a short chain that starts with a scan. Tools such as nmap and masscan look at ports 21, 22, 53, 80, 443 and 1080, and the actors then exploit what they find or harvest passwords with cross-site scripting payloads that display a fake login box.
For email they use an open-source tool called EBurst to spray and guess passwords against Microsoft Exchange sign-in interfaces, among them Outlook Web Access, Exchange Web Services and Autodiscover. For persistence they install SoftEther VPN clients, often named conhost.exe or dllhost.exe, which endpoint security is less likely to flag because the program is legitimate. Scripts then pull out emails and credentials.
What To Check This Week
Start with exposure, because every step above begins with something reachable from the internet. List what answers on ports 21, 22, 53, 80, 443 and 1080 and close what nobody uses, which is the advisory's first recommended action.
Then match your software to the table. If you run ProFTPD, BIND, Apache Struts, Pulse Connect Secure, GitLab, ONLYOFFICE DocumentServer, Strapi or an unpatched Bash, check the version and patch or retire it. The advisory also says to replace end-of-life products.
Finally, require multifactor authentication on webmail and VPN logins, which the advisory singles out, and review web-application logs for traversal, command-injection and enumeration attempts. For UK and EU organisations the signal is that the NCSC and Spain's CNI co-signed it and that court documents name a Polish airport among the networks scanned, so this is not only a US story.
Read next: Germany Sets 2030 and 2035 Quantum-Safe Deadlines | NetScaler's Third Zero-Day in 90 Days
