> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
- URL: https://f4n6.co.uk/security-feed/fbi-says-china-linked-hackers-ran-portal-giving-third-parties-access-to-stolen-emails/
- Published: 2026-10-08T23:41:42.000Z
- Updated: 2026-10-08T23:41:42.000Z
- Author: Jeff Davies
- Tags: #security-feed, Integrity Technology Group

## 1\. Executive summary

The FBI and agencies in six other countries stated on 8 October 2026 that hackers tied to Integrity Technology Group, a Chinese cybersecurity company sanctioned by the US and the UK, stole email from government organisations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia. The group scanned websites for flaws using a tool, and according to the headline claim ran a portal that gave third parties access to the stolen email. No CVE, no exploited component, no version, and no indicator of compromise is present in the source material, and the actor has no MITRE ATT&CK profile in our reference data, so the attribution to a Chinese state nexus is unconfirmed. For EMEA financial services the direct exposure is low unless you hold Southeast Asian operations, government or healthcare counterparties, or shared email infrastructure with the named victim sectors; the material risk is third-party and supply-chain, not a specific exploitable flaw. Treat this as a campaign-awareness item, not a patch action.

## 2\. Regulatory framing

| Article                                                | Trigger (the fact in this item)                                                                                                                                                                | Practical impact                                                                                                                                                                  |
| ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles | The actor is a named third-party cybersecurity vendor, and the reported portal gave external parties access to stolen email, which is a third-party access path rather than a direct intrusion | If you contract Integrity Technology Group or any entity in its group, Art. 28 requires you to assess and manage that third-party ICT risk; if you do not, no action is triggered |
| NIS2 Art. 21(2)(d): supply chain security measures     | Same fact: a sanctioned vendor is implicated in an email-compromise campaign against named sectors                                                                                             | Entities in scope must be able to show supply-chain security measures covering vendors of this profile; the trigger is the vendor relationship, not the incident itself           |

No DORA incident-reporting article (Art. 17, 18, 19) is engaged on the facts available: the source does not state that any EMEA entity was affected, and we have no incident at a client. If you later confirm compromise of your own systems, Art. 17 to 19 apply on your own facts, not on this report.

## 3\. Technical analysis & attack chain

The source is a news summary, not a technical report. It supports the following confirmed steps and nothing more:

1. Integrity Technology Group, a Chinese cybersecurity company, is alleged to have stolen email from government organisations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia.
2. The actor scanned websites for flaws using a tool. The source does not name the tool, the flaw class, or the scanning infrastructure.
3. The FBI and agencies in six other countries attribute the activity to hackers tied to the company, and state that a portal was run giving third parties access to the stolen email.

Everything beyond those three steps is absent from the source. There is no initial access vector, no exploited component or CVE, no payload or malware capability, no persistence mechanism, no privilege escalation, no command-and-control detail, no lateral movement, no exfiltration method, and no observed impact beyond email theft. The reference data confirms the actor has no MITRE ATT&CK profile, so we cannot map the activity to known techniques.

Two caveats apply. First, the attribution to a Chinese state nexus rests on a joint government statement reported by a single outlet in our source set; it is single-sourced here and should be treated as unconfirmed until corroborated by a technical report or a second government advisory. Second, the "portal giving third parties access" claim is a headline assertion with no supporting detail: no URL, no access model, no customer list. Do not build detection or blocking logic on it.

The one operationally useful fact is the victim profile: government, law enforcement, healthcare, and religious institutions in Southeast Asia. If your organisation has entities, subsidiaries, or critical suppliers in those sectors or that region, the campaign is relevant to your third-party risk review. If it does not, the item is background.

## 4\. Mitigation & containment

The source provides no vendor fix, no patch, and no version to pin, because no vulnerable product is named. The actions below are the ones the facts actually support.

### P1 (within 24 hours)

- Confirm whether Integrity Technology Group or any entity in its corporate group appears in your vendor, supplier, or subprocessor register. If it does, escalate to your third-party risk owner and begin the Art. 28 assessment described in §2.
- If you have Southeast Asian operations or suppliers in government, law enforcement, healthcare, or religious sectors, ask those suppliers whether they have been contacted by the FBI or a national agency about this campaign. Record the answer with a date.
- Do not add blocking rules for the actor or the alleged portal: no domain, IP, or hash is available, and inventing one would be worse than doing nothing.

### P2 (within 72 hours)

- Review email security logs for the last 90 days for anomalous access to executive, legal, and government-facing mailboxes at any Southeast Asian entity you operate. Look for impossible-travel logins, new mailbox delegation, and new mail-flow rules, which are the standard post-compromise email persistence patterns. This is a review of your own telemetry, not a signature match against this campaign.
- Verify that MFA is enforced on all mailboxes at those entities and that legacy authentication protocols are disabled. The source does not say how the email was taken, so closing the common email-access gaps is the defensible action.

### P3 (within 7 days)

- Add the victim-sector and region profile from §3 to your threat-intelligence watch list so that a future technical report on this actor is triaged against your exposure.
- If you hold a DORA or NIS2 supply-chain obligation, document the outcome of the P1 vendor check. The value is the record, not the check.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The source names no domain, IP, hash, file path, registry key, or email address, and we will not fabricate any.

## 6\. Detection

Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values. The only named entity is the vendor itself, which is not a threat artefact and would produce a rule that detects reporting about the campaign rather than the campaign.

## 7\. Sources

- The Hacker News, "FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails", https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html, published 2026-10-08.

## 8\. Adverse Trace position

We assess this as a low direct-severity item for most EMEA financial services clients and a medium third-party-risk item for those with Southeast Asian operations or suppliers in the named victim sectors. The attribution to a Chinese state nexus is unconfirmed: the actor has no MITRE ATT&CK profile in our reference data, and the claim rests on a single news report of a joint government statement. There is no CVE, no exploited component, and no indicator to act on, so we are not raising a patch or detection task. We will monitor for a technical report or a second government advisory that names the scanning tool, the exploited flaw class, or the portal infrastructure, and we will reissue this advisory with detection content if that material appears. Clients with a vendor relationship to Integrity Technology Group should contact their Adverse Trace analyst to scope the Art. 28 assessment.

---

[Read the original source →](https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*