Integrity Technology Group Portal Delivered Stolen Emails to Unnamed Third Parties Since 2021

The advisory details persistent access operations from January 2021 onward. Actors scanned ports 21, 22, 53, 80, 443, and 1080 with Nmap, masscan, WPScan, and the custom MicroScan Python suite containing over 1,300 exploit scripts targeting OpenSSL, Oracle WebLogic, WordPress, and Jenkins. Once inside, they guessed Microsoft credentials and exfiltrated mailboxes without specifying victim counts or exact theft dates. Evidence recovered during FBI investigations and the September 2024 Raptor Train botnet takedown shows the same infrastructure hosted both the stolen-email portal and a 200,000-device residential proxy network. Treasury sanctions in January 2025 and UK sanctions in December 2025 cite the firm’s chairman admitting intelligence collection for Chinese security services, yet the advisory collapses company employees and external customers into a single “threat actors” label. Independent tracking by Microsoft (Flax Typhoon) and Lumen (Raptor Train) shows overlapping infrastructure but no public technical proof that every mailbox theft was state-directed rather than commercial resale. The advisory omits any contract or procurement records that would clarify which Chinese agencies purchased access. Operational significance lies in the explicit third-party portal model, indicating a sustainable for-profit data brokerage rather than one-off espionage. Expect continued scanning campaigns and possible additional sanctions or infrastructure seizures if MicroScan signatures appear in new botnet telemetry within the next quarter.