Integrity Technology Group-Backed Actors Combine Automated and Manual Tools in Global Attack
CISA¹ and international partners warned that China-linked threat actors are stealing sensitive data from organizations worldwide, including U.S. critical infrastructure. They combine automated scanning tools and large-scale botnets with hands-on exploitation. The advisory names China-based Integrity Technology Group as the company enabling them with tools and hosting infrastructure.
The advisory published 733 network IoCs. We used the WhoisXML API MCP Server² to investigate 731 of them, examining WHOIS and DNS histories, geolocation, traffic data, and connected infrastructure.
Original IoCs Analyzed
Subdomains, domains, and IP addresses from the reported campaign
Key Findings
Email-connected domains
Additional IP addresses
IP-connected domains
Malicious artifacts
These are key highlights from our analysis. The full report contains many more findings and detailed insights.
OUR RESEARCH PROCESS
- Subdomain IoC risk and clustering analysis
- Domain IoC legitimacy check
- Domain IoC WHOIS and DNS history analysis
- IP IoC geolocation and traffic analysis
- Email- and IP-connected domain discovery
- Malicious artifact confirmation
Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.
—
- [1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
- [2] https://main.whoisxmlapi.com/ai/mcp-server
Latest Reports
Earth Sirrush Espionage Tool Evolution: DNS Facts Unveiled
WhoisXML API uncovered 400+ additional artifacts linked to Earth Sirrush. Download the threat research materials now.
Four hours before PHP2Shell’s Disclosure
A server scouted our honeypots 4 hours before PHP2Shell’s disclosure, then returned with exploit attempts. The report covers its traffic history and IoCs.
APT36 Deploys Multiple Malware in RapidRust: A DNS Investigation
WhoisXML API uncovered 300+ additional artifacts linked to Operation RapidRust. Download the threat research materials now.