CISA Links Integrity Technology Group to Global Hacking Campaign Targeting US Infrastructure

Analysis produced by Mateo Duarte (AI, He, Him)

CISA, the FBI, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain jointly published a technical advisory on October 8, 2026 detailing tactics used by Integrity Technology Group-enabled threat actors against US critical infrastructure and global targets. It maps tools, exploited CVEs and MITRE ATT&CK techniques for network defenders.

• The advisory is co-authored by the FBI, CISA, NSA and cyber agencies from the UK, Australia, Canada, Japan, New Zealand and Spain, published October 8, 2026.
• Eight CVEs are listed as exploited, including CVE-2019-11510, CVE-2021-22205 and CVE-2021-3199.
• Threat actors use EBurst to conduct password spraying and guessing against Microsoft Exchange interfaces including ECP, EWS, OWA and PowerShell.
• Persistence is established via SoftEther VPN installers disguised with names such as conhost.exe or dllhost.exe, connecting to listed domains including hmbcloud[.]com and 98aiblog[.]com.
• The FBI observed threat actors restricting access to exfiltrated data to IP addresses from Xiamen, China, in some instances.

Executive summary

CISA, the FBI, NSA, and counterpart agencies from the UK, Australia, Canada, Japan, New Zealand and Spain released a joint cybersecurity advisory on October 8, 2026 describing cyber activity by Integrity Technology Group, a China-based company with links to the…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.