US Agencies Link Integrity Technology Group to China-Backed Infrastructure Attacks
CISA, FBI, and NSA warn that a Chinese firm aids state-linked hackers in stealing data from critical sectors using botnets and scanning tools.
Key points
- US agencies identify Integrity Technology Group as enabling China-linked cyber operations against critical infrastructure.
- Threat actors use automated scanning, botnets, and hands-on techniques to infiltrate networks and exfiltrate credentials.
- The joint advisory urges organizations to review indicators of compromise and strengthen defenses around remote access.
The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the National Security Agency issued a joint warning detailing how Chinese government-linked threat actors are infiltrating networks globally. According to the advisory, these actors combine automated scanning, large-scale botnets, and manual hacking techniques to steal sensitive data from organizations across multiple sectors.
The agencies named Integrity Technology Group, a for-profit company based in China with government links, as a key enabler of these attacks. The firm provides infrastructure and tools that allow hackers to exploit U.S. and foreign organizations. The advisory highlights that these actors use compromised infrastructure alongside legitimate software to maintain persistent access and exfiltrate email data and user credentials.
Tactics and Attribution
In a recent 58-page advisory, the agencies linked the activity to threat groups publicly tracked as Flax Typhoon, Ethereal Panda, and Red Juliett. These actors target organizations across various sectors, including U.S. critical infrastructure. Their methods include exploiting vulnerabilities, conducting cross-site scripting attacks, and using password spraying to gain initial access to targeted networks.
The report details how the hackers leverage virtual private network software to establish persistence within compromised environments. By combining automated reconnaissance with hands-on hacking, they exploit internet-facing systems to move laterally. The advisory emphasizes that these actors aim to position themselves within operational technology systems, potentially to disrupt critical functions at a future time of their choosing.
Who Is Affected
The warning applies to organizations in multiple sectors, with a specific focus on U.S. critical infrastructure. Chris Butera, acting executive assistant director for cybersecurity at CISA, stated that Chinese government-affiliated actors continue to embed themselves within these networks. He urged organizations to review the advisory to understand the wide range of tactics used by these actors and to implement recommended mitigations.
The agencies stressed the importance of collaboration between government bodies and the private sector. They advised organizations to hunt for evidence of unauthorized access by reviewing the advisory’s indicators of compromise and documented tactics, techniques, and procedures. Strengthening defenses around internet-facing services, account credentials, and remote access is critical to mitigating exposure to these China-linked cyber operations.
What should you do?
Organizations should immediately review the technical indicators provided in the joint advisory to detect any signs of compromise in their environments. Security teams should audit internet-facing systems and remote access configurations to ensure they are hardened against automated scanning and password spraying. Monitoring for unusual VPN usage and cross-site scripting attempts can help identify early stages of infiltration.
What to do and how to stay safe: Integrity Technology Group
- Review the joint advisory's indicators of compromise to scan for evidence of unauthorized access in your network.
- Audit and strengthen security controls on internet-facing services and remote access protocols to prevent initial exploitation.
- Monitor account credentials and email systems for signs of exfiltration or suspicious activity associated with the named threat groups.
- Implement enhanced logging and monitoring for operational technology systems to detect persistent access attempts by state-linked actors.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which company is identified as enabling these cyber attacks?
Integrity Technology Group, a China-based for-profit company with government links, is identified as enabling the attacks.
What specific threat groups are associated with these activities?
The activities are linked to threat groups publicly tracked as Flax Typhoon, Ethereal Panda, and Red Juliett.
What tactics are these actors using to gain access?
Actors use automated scanning, botnets, cross-site scripting, password spraying, and VPN software to establish persistence.
