FBI Exposes Integrity Technology Group: China’s Flax Typhoon Ran a Stolen-Mailbox Portal — What Indian Enterprises Must Do Now

On October 8, 2026, the FBI, CISA, NSA and seven international partner agencies dropped a joint advisory that reframes how we should think about Chinese state-sponsored cyber espionage. It was not simply a report about hacking. It revealed that a Beijing-based company — Integrity Technology Group — had built a dark web portal that let paying clients browse stolen email inboxes belonging to government agencies, healthcare systems, and law enforcement organisations worldwide. That same day, the Justice Department seized the domains powering the group’s two main offensive tools: MicroScan and FishHub. For every enterprise running Microsoft Exchange — including thousands across India and South Asia — this advisory carries a direct, urgent message: if your Exchange environment is reachable from the internet and MFA is not universally enforced, you may already be a victim.

Who Is Integrity Technology Group?

Integrity Technology Group is a Beijing-based cybersecurity firm that the US Office of Foreign Assets Control (OFAC) sanctioned in 2025 for its role in computer intrusions against US victims. The UK followed with its own sanctions designation. Despite operating outwardly as a legitimate security contractor, the FBI’s October 2026 advisory alleges that the company acquired offensive cyber tools, leased attack infrastructure, and compromised networks at scale — then monetised that access by selling it to third-party clients.

The group’s activity is tracked under three public personas by different threat-intelligence vendors: Flax Typhoon (Microsoft’s label), Ethereal Panda (CrowdStrike), and Red Juliett (Recorded Future). The advisory is careful to note that not all activity attributed to these monikers necessarily traces back to Integrity Tech, but the tactics, techniques, and procedures (TTPs) are consistent. This matters because it unifies what previously appeared to be separate Chinese-nexus campaigns into a single contractor ecosystem.

The Attack Chain: From EBurst Password Spray to Stolen-Mailbox Portal

The advisory describes a multi-stage operation that is sophisticated precisely because much of it uses legitimate software and cloud APIs — a textbook living-off-the-land campaign.

1. Initial reconnaissance via MicroScan: The group’s custom vulnerability scanner profiles internet-facing Microsoft Exchange servers, identifying unpatched or misconfigured instances. This phase is largely automated and touches large swathes of address space.
2. Credential harvesting with EBurst: EBurst is an open-source Exchange password-spray toolkit. Attackers use it to methodically test common and breached passwords against discovered Exchange endpoints. With no MFA in place, a single valid credential is all that is needed.
3. Email exfiltration via Microsoft APIs: Once authenticated, actors use Microsoft’s own Exchange Web Services (EWS) and Microsoft Graph APIs to silently bulk-export mailbox contents. No additional malware is required — the operation looks like legitimate mail client activity.
4. Controlled access portal: Exfiltrated email is loaded into a web application that the advisory describes as providing “third-party access to stolen email content.” Access to this portal was, in at least some observed cases, restricted to IP addresses in Xiamen, China — suggesting that access was sold or granted to a defined set of clients rather than broadcast openly.
5. Spear phishing amplification via FishHub: Stolen email content fed FishHub, a purpose-built spear-phishing platform, enabling highly personalised follow-on attacks against targets in the victim organisations’ contact graphs.

This chain transforms a standard credential-based intrusion into a persistent intelligence collection programme. The stolen email portal is the distinguishing element: it shifts the operation from a one-time breach into an ongoing espionage-as-a-service model.

The FBI’s October 8 Action: MicroScan and FishHub Taken Down

On October 8, the Justice Department executed a court-authorised seizure of seven domains that supported MicroScan and FishHub operations. Visitors to those domains now see FBI seizure notices naming Integrity Technology Group and the Flax Typhoon group. The takedowns disrupt the infrastructure but do not eliminate the threat: the underlying actors remain at large, and the advisory explicitly warns that the group can rebuild operational capacity.

This is the second significant FBI action against Flax Typhoon infrastructure. In 2024, the Bureau disrupted a botnet of more than 260,000 compromised devices — primarily small-office/home-office routers — that the group used as a global proxy network to mask its origin traffic.

Target Sectors and the South Asia Dimension

The advisory’s target list reads like a directory of sensitive Indian institutional sectors:

Sector	Relevance for Indian Enterprises
Government & Law Enforcement	Central ministries, state police departments, central agencies using Exchange
Healthcare	Hospital chains, pharma manufacturers, clinical research organisations
Critical Manufacturing	Defence PSUs, semiconductor fab suppliers, auto component plants
Information Technology	IT services firms, BPOs holding client email archives
Education & Religious Institutions	IITs, IIMs, major universities with Exchange deployments

Southeast Asia is explicitly named in the advisory as a targeted region, and India occupies a uniquely exposed position: it shares a tense border with China, hosts significant defence and strategic manufacturing, and has a vast installed base of on-premises Microsoft Exchange servers — many upgraded infrequently. The combination of geopolitical tension and infrastructure exposure makes Indian organisations a logical extension of this campaign.

What You Should Do Now — Sanjay Seth’s Expert Perspective

I have spent three decades hardening networks across Delhi NCR and advising CISOs on zero-trust architectures. The Integrity Tech advisory is a canonical example of why perimeter-only defences fail: the attackers used no zero-day vulnerabilities in the exfiltration phase. They used your users’ passwords and your own email APIs. Here is the immediate action plan:

• Audit Exchange exposure right now. Run Get-ExchangeServer | Select-Object -Property Name,AdminDisplayVersion,ExternalUrl and confirm which Exchange servers have EWS or OWA exposed to the internet. Every internet-facing Exchange instance that is not behind a WAF or zero-trust access proxy is a target.
• Enforce MFA universally — no exceptions. EBurst cannot succeed against accounts protected by multi-factor authentication. Use Conditional Access policies in Entra ID (Azure AD) to block legacy authentication protocols (SMTP AUTH, POP3, IMAP) that bypass MFA. FortiAuthenticator paired with FortiGate can enforce this at the network layer for hybrid environments.
• Search logs for EBurst-pattern activity. Look for rapid sequential failed authentication events from single IPs against Exchange OWA or EWS endpoints, especially from Autonomous System Numbers (ASNs) associated with Chinese hosting providers. Check Microsoft Unified Audit Log for anomalous MailItemsAccessed and UpdateInboxRules events.
• Block or restrict EWS and Graph API for external access. If your users do not need to access mailboxes from arbitrary external IPs, restrict EWS access to known, authorised IP ranges via Exchange throttling policies or firewall rules.
• Review the AA26-281A IoCs. The CISA advisory page includes indicators of compromise. Feed these into your SIEM correlation rules and FortiGate threat-feed blocklists within 24 hours.
• Treat email compromise as a network compromise. If any mailbox was accessed by unauthorised parties, rotate all credentials associated with that account, review forwarding rules, and hunt for lateral movement from the compromised identity. Stolen email can contain tokens, VPN credentials, and internal architecture diagrams.
• Zero-trust email access. The long-term fix is to route all email access through a zero-trust network access (ZTNA) broker that verifies device health and identity before allowing any mailbox API call — regardless of whether the user is on-premises or remote. This model renders EBurst-style spraying irrelevant because even a valid password cannot satisfy a posture check. See how high-availability SD-WAN and ZTNA architectures can be combined to enforce this at scale.

For organisations that have already been targeted — particularly those in healthcare, government, or defence supply chains — this is not a patch-and-forget event. Treat it as a potential long-running intrusion and commission a full Exchange audit and threat hunt before closing the ticket.

The Bigger Picture: Espionage-as-a-Service Is the New Normal

What makes Integrity Tech significant is not the scale of any single breach — it is the business model. By running a portal that sells access to stolen email, the group has created a repeatable revenue stream from compromised organisations. This mirrors the ransomware-as-a-service (RaaS) model that transformed cybercrime. We are now seeing its espionage equivalent: contractor companies with government ties that monetise intelligence collection by selling it to multiple state and non-state buyers.

The implication for defenders is stark: a breach of your email environment may not produce an immediate, visible incident. If the attacker’s goal is to quietly provide ongoing access to a portal, they have every incentive to stay invisible. You may not know you have been compromised until a journalist calls or a partner organisation notifies you. That is why proactive threat hunting and zero-trust access controls — not reactive incident response — must be the foundation of your email security programme.

The BleepingComputer coverage and The Hacker News report both confirm the domain seizures and provide additional technical context. Help Net Security has the most detailed breakdown of MicroScan and FishHub capabilities. Cross-reference all of these against the Microsoft Exchange privilege-escalation flaw we covered earlier this week — attackers combining CVE-2026-96940 with the EBurst spray technique would have a powerful compounded attack chain.

Frequently Asked Questions

Does this advisory affect organisations running Microsoft 365 (cloud Exchange)?

Yes. While on-premises Exchange servers are the primary vector described in the advisory, Microsoft 365 is not immune: if an account is compromised via password spraying and has no MFA, the same Graph API–based exfiltration technique applies. The fix — MFA and Conditional Access policies blocking legacy auth — is the same for both deployments.

How do I check if my Exchange server was targeted by EBurst?

Search your IIS logs and Windows Security Event Log (Event ID 4625, 4771) for high-frequency authentication failures against OWA, EWS, or Autodiscover endpoints from a single source IP within short time windows. Also check the Microsoft Unified Audit Log (UAL) for MailItemsAccessed operations from unusual client application strings or IP addresses that do not match your normal user geography.

The FBI seized the MicroScan and FishHub domains — is the threat over?

No. Domain seizures disrupt the current infrastructure but do not neutralise the operators. Integrity Technology Group as an organisation remains active, and the advisory explicitly warns that the group has the capability to rebuild. Treat the seizure as a temporary degradation, not an all-clear.

Is this campaign specifically targeting India?

The advisory does not name India directly, but it targets Southeast Asia broadly and sectors that are prominent in India’s economy: IT, healthcare, manufacturing, and government. Given ongoing India-China geopolitical tensions and the sheer volume of on-premises Exchange deployments across Indian enterprises, Indian security teams should treat themselves as a plausible target and act on the defensive guidance immediately.

Is your email environment built to withstand a nation-state adversary?
Integrity Technology Group’s operation shows that a valid password and an internet-facing Exchange server is all an adversary needs to build a persistent intelligence collection programme against your organisation. P J Networks offers Exchange security assessments, zero-trust access architecture reviews, and SIEM rule development to detect exactly the patterns described in advisory AA26-281A. Book a confidential security assessment with Sanjay Seth today.