Hackers are stealing email through doors left open years ago.

What happened

The NCSC joined agencies from the US, Australia, Canada, Japan, New Zealand and Spain in a joint advisory about hackers linked to the Chinese government. It names Integrity Technology Group, a Beijing company the UK has already sanctioned, as the business supplying them with tools and infrastructure.

Their goal is sensitive data, and above all email. The advisory says the activity goes back to at least 2021.

How they get in

Not with clever new tricks. That's the part worth paying attention to.

• Old, known flaws. The weaknesses listed in the advisory are not new. They include a VPN flaw from 2019 and a GitLab flaw from 2021, both fixed by the makers years ago. The doors were open because nobody installed the updates.
• Password spraying. Trying a few common passwords against lots of email accounts at once, slowly enough not to trigger lockouts.
• Staying hidden. Once in, they use connected apps, scripts and legitimate remote access tools to keep copying email without anyone noticing.

Why this matters if you're not a government

The scanning is automated. The tools don't check who you are before they try the door. They look for anything unpatched, anywhere, and a ten-person firm with an old firewall looks exactly the same as a ministry with one.

Businesses are also a well-known route into bigger ones, through the suppliers and partners who email them every day. And once someone is reading your email, they have everything they need for invoice fraud: real conversations, real invoices and the right moment to change the bank details.

Five things to check this week

1. Update your firewall, router and VPN. These sit on the internet and get scanned constantly. Check they're on the latest firmware, and that the maker still supports them. If they don't get updates any more, replace them.
2. Turn on multi-factor authentication for every email account. Including shared mailboxes, old admin accounts and the account a former employee used. Password spraying is useless against an account that needs a second step.
3. Check which apps can read your email. In Microsoft 365, look in the Microsoft Entra admin centre under Enterprise applications. In Google Workspace, it's the Admin console under Security, then API controls. Remove anything you don't recognise.
4. Look at your sign-in logs. Lots of failed sign-ins across many accounts, often from abroad, is what password spraying looks like.
5. Check your email domain. Run it through the free email security checker to make sure nobody can send email pretending to be you.

If those look familiar, it's because they're the basics of Cyber Essentials: firewalls, secure settings, keeping software updated and controlling who has access. The government-backed scheme exists for exactly this kind of attack.

If you think someone's already in

Signs include email rules you didn't create, replies to messages you never sent, or sign-ins from places you've never been. My guide to what to do when business email is hacked covers the first hour. If you'd rather not do it alone, my cyber incident response can take it from there.

Sources

• NCSC: China-linked malicious actors called out by UK and international partners
• CISA advisory AA26-281A (full joint advisory)