Ten agencies tie China-linked intrusions across several sectors to Integrity Technology Group
Integrity Technology Group, a government-linked Chinese firm, enables China-linked hackers to breach US and foreign networks, ten agencies said. The advisory treats the firm and its crews as one set of actors, so a single hunt can span sectors.
The Watch · Security desk
What happened
- The crews combine large-scale botnets, VPN infrastructure, living-off-the-land techniques and repositories of network exploitation tools, the advisory says.
- Victims span US government, critical manufacturing, healthcare and IT, plus law enforcement, education, religious groups and organizations in Southeast Asia, Africa and North America.
- The advisory's evidence was recovered from, and observed during, multiple FBI investigations related to Integrity Tech.
- Integrity Tech is run for profit, acquires or builds cyber tools for sale as well as use, and employs people who break into victim networks directly.
Why it matters
- What's now possible capability One sweep against infrastructure Integrity Tech hosts can surface intrusions a defender had filed under different actor names, because several crews draw on the same supplier.
- Who's exposed exposure A clean result against the Integrity Tech indicators does not clear a network, since the advisory says the same crews also run operations not associated with the firm.
- Who has to decide decision Law enforcement, education and religious organizations are on the victim list, so the hunt request applies to them as much as to the four named critical infrastructure sectors.
Next story · Security · Oct 9
Allied advisory details hacking toolkit of sanctioned Chinese firm Integrity TechConfirmed2 publishers
The advisory says activity matching the crews Integrity Tech enables is publicly known as Flax Typhoon, Ethereal Panda and Red Juliett, among other names [7]. A team that keeps separate case files under two of those names may be tracking customers of the same supplier. The agencies also warn that vendor groupings "may not be a 1:1 correlation to the US Government's methodology" [9]. Merging cases on a vendor label alone can pull in activity the government groups differently.
The advisory supports a cross-sector hunt for one toolkit, but its wording stops short of treating every match as the same operator. It calls the combination of tools unique [2]. It says the techniques themselves "are not unique to Chinese threat actors" [4]. On those terms, one botnet address or one living-off-the-land command in a log is a lead to check against the indicator list. The agencies publish that list as a separate download [11].
I'd expect the hosted infrastructure to be the part that repeats from victim to victim. Integrity Tech acquires and hosts infrastructure for the crews it enables [13]. Its services feed what the advisory calls "the larger Chinese cyber ecosystem, which aims to exfiltrate sensitive data from victims around the world" [12].
The FBI, CISA and NSA signed with the national cyber agencies of the UK, Australia, Canada and New Zealand [10]. Japan's National Police Agency and National Cybersecurity Office signed, as did Spain's Centro Nacional de Inteligencia [10]. Ten organisations in seven countries are on it [16]. They ask defenders to hunt for compromises from this activity and to harden against it and other Chinese government-linked targeting [3].
What to watch
- Whether firms that track Flax Typhoon, Ethereal Panda and Red Juliett re-map those clusters to the government's Integrity Tech grouping.
- Hunt results from the named victim sectors that match the published indicators, which would show how far one supplier's infrastructure reaches.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+12
- Incentives60
- Confidence74
Perspective Coverage
14 publishers- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Integrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit US and foreign organization networks across multiple sectors using various tools and techniques.
- [2]
The threat actors use a unique combination of large-scale botnets, virtual private network (VPN) infrastructure, living-off-the-land (LOTL) techniques, and repositories of computer network exploitation (CNE) tools.
- [3]
The authoring organizations urge network defenders to hunt for potential compromises from this activity and to better protect against this threat activity and other Chinese government-linked cyber targeting.
- [4]
Although these techniques are not unique to Chinese threat actors, the advisory details how the threat actors use them to support CNE activity.
- [5]
Integrity Tech is a China-based for-profit company with links to the Chinese government that employs individuals who support malicious cyber activity, including acquiring or building cyber tools for use and sale and compromising networks across global victims.
- [6]
The threat actors targeted victims across multiple US critical infrastructure sectors, including Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology; they also targeted victims in US law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, and North America.
- [7]
The threat actors enabled by Integrity Tech use TTPs consistent with the cyber activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett, among others.
- [8]
The threat actors enabled by Integrity Tech may also perform activity not associated with Integrity Tech.
- [9]
Cybersecurity companies have different methods of tracking and attributing cyber actors, and these may not be a 1:1 correlation to the US Government's methodology and understanding for all activity related to these groupings.
- [10]
The authoring organizations are the FBI, CISA, NSA, NCSC-UK, ASD's ACSC, the Canadian Centre for Cyber Security, Japan's National Police Agency and National Cybersecurity Office, New Zealand's NCSC-NZ, and Spain's Centro Nacional de Inteligencia.
- [11]
The advisory provides indicators of compromise, including a downloadable copy of the IOCs.
- [12]
The services provided by Integrity Tech contribute to the larger Chinese cyber ecosystem, which aims to exfiltrate sensitive data from victims around the world.
- [13]
Integrity Tech employs individuals who acquire and host infrastructure in support of malicious cyber activity.
- [14]
The advisory analyses TTPs and IOCs from Integrity Technology Group and the threat actors they enable, referring to them collectively as 'the threat actors'.
- [15]
The information in the advisory originates from technical evidence recovered from, and observed during, multiple FBI investigations related to Integrity Technology Group.
- [16]
Ten authoring organizations from seven countries signed the advisory.
Sources
13 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comFBI disrupts Chinese hacking tools used to breach critical infrastructure
1 article · October 8, 2026
- cisa.govCISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide | CISA
2 articles · October 8, 2026
- cyberscoop.comDOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
1 article · October 8, 2026
- dev.toFlax Typhoon: MicroScan Scanned Japanese Airports; U.S. Seizes Seven Domains
2 articles · October 10, 2026
- fastcompany.comFBI seizes Chinese hacking tools used for cyberattacks on critical U.S. infrastructure
1 article · October 9, 2026
- fortune.comFBI says it seized phishing tools used by Chinese hackers in ‘indiscriminate and reckless’ cyber operation
1 article · October 8, 2026
- helpnetsecurity.comFBI disrupts Flax Typhoon hacking tools used in global cyberattacks
1 article · October 9, 2026
- itpro.comUS seizes vulnerability scanning and spear phishing tools used by China-sponsored hackers
1 article · October 9, 2026
- justice.govOffice of Public Affairs | Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored Hackers | United States Department of Justice
1 article · October 8, 2026
- securityaffairs.comUS Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools
1 article · October 9, 2026
- securityweek.comUS Disrupts Chinese State-Sponsored Hacking Tools
1 article · October 9, 2026
- thecyberexpress.comFBI Takes Down China-Linked Tools That Scanned US Utilities
1 article · October 8, 2026
- thehackernews.comFBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
1 article · October 8, 2026
- therecord.mediaInternational coalition seizes tools used by cyber firm behind Flax Typhoon
1 article · October 8, 2026
Topics and entities
Topics
- Spear Phishing
- China state-linked cyber operations
- Law-enforcement cyber takedowns
- Joint cybersecurity advisories
- IoT and Edge Device Botnets