The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and partner agencies from six other countries issued a joint advisory on October 8, 2026, tying a sprawling email-theft campaign to hackers linked to Integrity Technology Group, a China-based, for-profit cybersecurity company the United States and the United Kingdom have already sanctioned, according to The Hacker News. The same news cycle carried a second, related China-linked story: the U.S. State Department’s Rewards for Justice program is now offering up to $10 million for information on Zhang Yu, a Chinese national charged over the 2021 HAFNIUM attacks on Microsoft Exchange Server, per SecurityWeek.
Together, the two disclosures describe a pattern that has defined Chinese state-linked hacking for half a decade: go after Microsoft’s email stack, steal mailboxes at scale, and let years pass before the public bill comes due. For IT security teams, the china hackers email theft story landing on the same day as a fresh bounty on an old HAFNIUM suspect is not a coincidence of timing so much as a reminder that these campaigns rarely close out cleanly. One gets a joint advisory. The other gets a seven-figure price tag on a name.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the Joint Advisory Says Happened
According to the October 8 advisory (identified as AA26-281A) cited by The Hacker News, the hackers tied to Integrity Technology Group stole email from government organizations, law enforcement agencies, healthcare systems and religious institutions across Southeast Asia. The FBI and agencies in six other countries co-signed the attribution, though the available reporting at publication time does not name all six international partners individually. What is confirmed is the breadth of the victim set: four distinct sectors, spanning the kind of organizations that hold both sensitive diplomatic correspondence and personal health records.
The advisory frames this as espionage-grade mailbox collection, not a smash-and-grab ransomware job. There is no ransom note in this story. Instead, the goal appears to be quiet, sustained access to institutional email, the kind of access that pays off over months or years rather than days. That distinction matters for how defenders should respond, and it echoes a theme this site covered when CrowdStrike tied an AI agent to China-linked actors in a separate banking-sector intrusion.
Who Is Integrity Technology Group
The agencies behind the advisory describe Integrity Technology Group as “a China-based for-profit company with links to the Chinese government” whose employees build or acquire cyber tools “for use and sale,” host infrastructure, and conduct the actual network intrusions themselves, per the joint statement reported by The Hacker News. That three-part business model (tool development, infrastructure hosting, and hands-on-keyboard intrusion) is notable because it blurs the line between a contractor and an operator. The company does not appear to be a shell; it is sanctioned, named, and apparently still active enough to warrant a fresh multinational advisory in October 2026, one that said the activity had operated since at least January 2021.
Both the United States and the United Kingdom have sanctioned Integrity Technology Group, according to the same reporting. The exact sanction dates and the specific legal authorities used were not detailed in the material available at publication, so this article treats that detail as confirmed in direction (sanctioned, by both governments) without overstating the specifics.
Inside the Scanning Tool and Password-Spray Campaign
The technical playbook described in the advisory is unglamorous but effective. Hackers linked to the group used a scanning tool containing more than 1,300 scripts to probe websites and networks for exploitable weaknesses, alongside password-guessing tools and mailbox-collection tooling, The Hacker News reported. That is not a single zero-day; it is a library built to find whatever soft spot exists on a given day, across a huge number of targets, without needing a novel exploit for each one.
From Scanning to Spraying
Once weak points were identified, the operators moved to password-spraying attacks against Microsoft 365 and Microsoft Exchange accounts, with scripts using Exchange Web Services to access email, calendars, and contacts. Password spraying is the opposite of a brute-force attack on one account: rather than trying thousands of passwords against a single login, attackers try a handful of common passwords across thousands of accounts, banking on the statistical certainty that somebody, somewhere, is still using a weak or reused credential. It is cheap, it is quiet, and multifactor authentication gaps make it devastating against exactly the kind of under-resourced government and healthcare IT departments named as victims here.
This is also where the story connects to the enterprise security market. Organizations that have already suffered large-scale breaches through under-protected cloud email, like the one detailed in our coverage of the Oracle Health breach affecting nearly 20 million people, keep demonstrating that identity hygiene around widely used platforms remains the softest target in most networks, not the newest exploit.
The Mailbox Theft-as-a-Service Portal
Perhaps the most striking detail in the advisory is what happened after access was gained. The hackers ran a web application that “provides third-party access to stolen email content,” according to the advisory as cited by The Hacker News. In plain terms, the group appears to have built infrastructure to let other parties browse or retrieve the mailboxes it had already compromised, rather than keeping the access strictly to itself.
That detail turns a traditional espionage operation into something closer to an access broker model, the same economic logic that has reshaped ransomware over the past several years. Initial-access brokers sell footholds; this portal appears to sell (or share) the harvested content itself. For defenders, it is a reminder that a single compromised mailbox is rarely the end state. It can become a product.
A Separate $10 Million Reward Reopens the HAFNIUM Case
On the same day, the U.S. State Department’s Rewards for Justice program announced it is offering up to $10 million for information on Zhang Yu, a Chinese national the United States charged in connection with the 2021 HAFNIUM attacks on Microsoft Exchange Server, according to Security Affairs and The Deep Dive. The official language, published directly by the State Department, is specific: the reward covers information leading to the “identification or location” of any person acting at the direction of a foreign government who participates in malicious cyber activity against U.S. critical infrastructure, in violation of the Computer Fraud and Abuse Act, per the Rewards for Justice program.
The Nine-Count Indictment
Zhang was charged in a nine-count hacking indictment tied to the Exchange Server attacks, with related reporting also linking the broader case to alleged theft of COVID-19 research from U.S. institutions beginning in early 2020, according to CyberPress. The available reporting does not establish a precise operational role, such as developer versus operator, with enough certainty to state one here.
Still at Large, Reward in Hand
Five years after the original HAFNIUM attacks became public, Zhang remains at large, according to the same reporting. The $10 million figure places him in the same financial tier as rewards previously offered for some of the most senior accused state-linked hackers the United States has pursued, a signal that Washington still views the original Exchange Server campaign as unfinished business rather than a closed case.
Why Two China-Linked Stories Broke the Same Day
It would be a mistake to treat the Integrity Technology Group advisory and the Zhang Yu reward as a single unified operation; the available reporting does not establish that they are the same campaign, the same group, or even the same era. One is a live 2026 advisory about ongoing mailbox theft across Southeast Asia. The other is a five-year-old case getting a fresh financial incentive. What connects them is the target: Microsoft’s email infrastructure, first through on-premises Exchange Server zero-days in 2021, now through password spraying against Microsoft 365 and Exchange accounts in 2026, a campaign that targeted both on-premises Exchange environments and cloud mailboxes, according to coverage of the joint advisory.
That continuity is itself the story. Attackers do not need a new exploit every year when the old attack surface, weak or reused passwords, is still there to exploit. Separate reporting this site covered on South Korea’s investigation into AI-assisted bank hacking shows the same underlying pattern: state-linked actors returning to familiar financial and institutional targets with incrementally updated tooling rather than wholesale new methods.
Market Impact: Email Security, EDR and Cyber Insurance
For enterprise security buyers, this story lands at an awkward moment. Microsoft 365 is the default email platform for a large share of the government and healthcare organizations named as a sector, if not individually, in the advisory. A campaign built on password spraying, not a software vulnerability, puts pressure squarely on identity and access management budgets rather than patch management teams. Expect renewed procurement interest in phishing-resistant multifactor authentication, conditional access policies, and identity threat detection, the same category covered in detail in our CrowdStrike vs Microsoft Defender vs SentinelOne comparison.
Cyber insurers that underwrite public-sector and healthcare clients in Southeast Asia will likely revisit questionnaires to ask specifically about Microsoft 365 conditional access and legacy authentication protocols, both common weak points in password-spray incidents. Meanwhile, the sanctions angle adds a layer most breach stories lack: a named, sanctioned company tied to the activity gives procurement and compliance teams a concrete entity to screen against in third-party risk assessments, a problem this site has tracked in the context of vendor exposure after major breaches.
How This Compares to Past China-Linked Email Campaigns
The table below lines up the two China-linked storylines that converged in the October 8 news cycle, drawing only on confirmed reporting rather than speculation about links between them.
| Attribute | Integrity Technology Group Campaign | Zhang Yu / HAFNIUM Case |
|---|---|---|
| Entity type | Company (China-based, for-profit) | Individual (Chinese national) |
| Alleged role | Builds/sells cyber tools, hosts infrastructure, conducts intrusions | Charged participant in 2021 Exchange Server attacks |
| Primary target | Microsoft 365 and Exchange accounts, Southeast Asia government, healthcare, law enforcement, religious orgs | On-premises Microsoft Exchange Server, global |
| Government action | Sanctioned by the U.S. and UK; named in Oct. 8, 2026 joint advisory | $10 million Rewards for Justice offer; nine-count indictment |
| Current status | Named and sanctioned; advisory newly issued | At large, per State Department reporting |
The pattern across both rows is consistent: Microsoft’s email ecosystem, whether on-premises or cloud, remains the preferred entry point for Chinese state-linked operators pursuing government and institutional targets, five years apart.
The Attack Chain, Stage by Stage
Breaking the 2026 campaign into its component stages makes clear why it was hard to catch early and why the response is a joint multinational advisory rather than a single vendor patch.
| Stage | Described Activity | Why It Matters |
|---|---|---|
| Reconnaissance | Scanning tool with 1,300+ scripts probes sites and networks for weaknesses | Scales discovery across many targets without a single novel exploit |
| Initial access | Password-spraying against Microsoft 365 and Exchange accounts | Exploits weak/reused credentials, not software flaws, bypassing patch cycles |
| Collection | Mailbox content copied once access is gained | Targets communications, not just files or credentials |
| Monetization/sharing | Web portal provides third-party access to stolen email content | Converts stolen access into a distributable product |
| Attribution | Activity tied to Integrity Technology Group, sanctioned by U.S. and UK | Gives defenders a named entity for risk screening and threat intel |
What Officials and Outlets Are Saying
Direct, named quotations from individual officials were not available in the reporting reviewed for this story, but the agencies’ and outlets’ own language is specific enough to carry the weight of the disclosure. The FBI and partner agencies stated plainly that “hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia,” as reported by The Hacker News.
On the attribution itself, the agencies described Integrity Technology Group as “a China-based for-profit company with links to the Chinese government” whose employees build or get cyber tools “for use and sale,” host infrastructure, and break into networks, per the same reporting. And on the collection infrastructure, the advisory noted that the hackers also run a web application that “provides third-party access to stolen email content,” according to The Hacker News.
On the reward side, the U.S. Department of State’s own published language states it “is offering up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act,” per the Rewards for Justice listing.
Historical Context: From ProxyLogon to Password Spraying
The 2021 HAFNIUM attacks, widely known by the ProxyLogon exploit chain name, were a watershed moment for enterprise email security. Microsoft’s own March 2021 disclosure described a mass-exploitation campaign (reported HAFNIUM activity began in late 2020) against on-premises Exchange Server deployments that drove an emergency patch cycle across tens of thousands of organizations worldwide, a scale of disruption that pushed many enterprises toward cloud email migration in the years that followed. The irony sitting at the center of the 2026 advisory is that the migration to Microsoft 365 did not remove the underlying target. It shifted much of the attack surface from server-side code execution to account-level credential abuse, and the 2026 campaign reached both on-premises Exchange and Microsoft 365 mailboxes.
Pentagon-adjacent institutions have felt this shift directly. Our earlier coverage of the Pentagon breach exposing 3.05 million military records showed how large, high-value government datasets remain exposed not necessarily through novel exploits, but through the accumulation of smaller access failures across complex identity systems, the same structural weakness password spraying is built to exploit.
What Defenders Should Do Now
Security teams at government, healthcare, law enforcement and religious organizations, particularly in Southeast Asia but not exclusively, should treat this advisory as a prompt to audit Microsoft 365 and Exchange authentication posture specifically. Three steps stand out based on the attack chain described above.
- Enforce phishing-resistant multifactor authentication across all Microsoft 365 and Exchange accounts, closing the gap password-spraying attacks rely on.
- Review conditional access and legacy authentication protocol settings, since older protocols often bypass modern MFA enforcement entirely.
- Monitor for anomalous mailbox access patterns and bulk export activity, the signature of the mailbox-copying stage described in the advisory.
A simplified version of the kind of anomaly logic security teams are building into their detection rules looks like this, flagging a spike in failed logins across many distinct accounts from a shared source in a short window, the statistical signature of spraying rather than targeted guessing:
// Illustrative detection logic, not an official IOC from the advisory
SigninLogs
| where ResultType == "50126" // invalid credentials
| summarize FailedAccounts = dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 1h)
| where FailedAccounts > 15
| project IPAddress, FailedAccounts, TimeGeneratedPredictions: Where This Goes Next
Five predictions follow from the pattern established by this advisory and the parallel Zhang Yu reward.
- Expect additional sanctions designations against Chinese cybersecurity companies operating under a similar for-profit, state-linked model, since Integrity Technology Group’s structure gives regulators a template to search for lookalikes.
- Rewards for Justice offers tied to older, unresolved China-linked cases are likely to keep surfacing, as Washington uses financial incentives to keep pressure on individuals who remain out of reach of extradition.
- More governments beyond the U.S. and UK will likely join future sanctions actions against entities tied to this campaign, following the six-country co-signatory pattern seen in the October 8 advisory.
- Enterprise adoption of phishing-resistant authentication for Microsoft 365 will accelerate among government and healthcare organizations specifically named as at-risk sectors in this advisory.
- Expect continued convergence between espionage-style mailbox theft and access-broker economics, as the third-party access portal described here suggests stolen institutional email is increasingly treated as a sellable asset rather than a strictly intelligence product.
Frequently Asked Questions
What did the October 8, 2026 advisory actually say?
The FBI, CISA, NSA and agencies from six other countries attributed an email-theft campaign against government, law enforcement, healthcare and religious organizations in Southeast Asia to hackers linked to Integrity Technology Group, a sanctioned Chinese cybersecurity company, according to The Hacker News.
Is the Zhang Yu reward connected to the Integrity Technology Group advisory?
The available reporting does not establish a direct operational link between the two. They are separate China-linked stories that broke the same day: one a live 2026 advisory, the other a reward tied to the 2021 HAFNIUM Exchange Server case.
How much is the U.S. offering for information on Zhang Yu?
Up to $10 million, through the State Department’s Rewards for Justice program, for information leading to his identification or location, per the program’s official listing.
What method did the Integrity Technology Group-linked hackers use to get in?
Reports describe a scanning tool with more than 1,300 scripts used to find weaknesses, followed by password-spraying attacks against Microsoft 365 and Exchange accounts, according to The Hacker News.
Has Integrity Technology Group been sanctioned before this advisory?
Yes. Both the United States and the United Kingdom had already sanctioned the company prior to the October 8, 2026 advisory, according to the same reporting.
Is Zhang Yu in custody?
No. He remains at large, which is why the State Department is offering a reward for information on his identification or location rather than announcing an arrest.
What should organizations do in response to this advisory?
Security teams should prioritize phishing-resistant MFA on Microsoft 365 and Exchange accounts, audit legacy authentication protocols, and monitor for bulk mailbox access patterns consistent with the collection stage described in the advisory.
Were any specific victim organizations named?
The advisory described victim sectors, government, law enforcement, healthcare and religious institutions, rather than naming individual organizations in the reporting reviewed for this story.
