Chinese Cyber Actors Exploit Vulnerabilities via Integrity Technology Group

• •Chinese threat actors exploit CVE-2015-5477 and CVE-2023-22894 for data theft.
• •Integrity Technology Group supports a range of cyber operations targeting critical sectors.
• •Joint alert from U.S., UK, and allies highlights the urgency for enhanced cybersecurity measures.

Chinese government-linked cyber threat actors, associated with Integrity Technology Group, are using a combination of automated tools and hands-on techniques to exploit vulnerabilities and steal sensitive data from organizations globally. They target critical infrastructure sectors, including government, healthcare, and IT, employing methods such as cross-site scripting and password spraying on Microsoft Exchange servers. Recent reports indicate that they utilize tools like MicroScan and EBurst for initial access and persistence, while exfiltrating data using scripts. The U.S. And allied nations have issued a joint alert detailing these activities, emphasizing the need for organizations to implement security measures such as disabling unused services and applying multifactor authentication. The vulnerabilities exploited include CVE-2015-5477 and CVE-2023-22894, both added to CISA's KEV list on 2026-10-08, indicating. Organizations are urged to prioritize security updates and implement best practices to mitigate risks.