CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide

Government agencies, including CISA, the FBI, and the NSA, along with international partners, have issued a joint advisory warning about a China-based cybersecurity company named Integrity Technology Group (Integrity Tech). The advisory states that Integrity Tech enables threat actors to target multiple critical infrastructure sectors globally using advanced tools like botnets, VPN infrastructure, and living off the land techniques. This activity has been observed in North America, Southeast Asia, and Africa.
The advisory highlights that Integrity Tech is a key enabler of malicious cyber activity through the acquisition or development of cyber tools, hosting infrastructure, and network compromises worldwide, often with ties to the Chinese government. These actors utilize tactics consistent with known threat groups such as Flax Typhoon, Ethereal Panda, and Red Juliett, focusing on stealthy access to unmonitored edge devices. CISA urges organizations to implement recommended mitigations, including patching known vulnerabilities (CVEs), to secure their networks.
The FBI Cyber Division stated that Integrity Technology Group is one of the enterprises supporting actors targeting critical infrastructure by providing tools and hosting infrastructure. The advisory specifically notes that these actors have targeted critical infrastructure across sectors including government, manufacturing, healthcare, as well as law enforcement and education organizations in the US. The joint warning emphasizes the need for collaboration between government agencies and the private sector to counter this threat.

* CISA, FBI, NSA, and international partners issued a joint Cybersecurity Advisory.
* The advisory warns that Integrity Technology Group (Integrity Tech), a China-based cybersecurity company, enables threat actors to target critical infrastructure sectors worldwide.
* Threat actors use sophisticated tools including large-scale botnets, virtual private network infrastructure, and living off the land techniques.
* Activity has been observed in North America, Southeast Asia, and Africa.
* Integrity Tech is a key enabler of malicious cyber activity by acquiring or developing cyber tools, hosting infrastructure, and compromising networks globally due to ties to the Chinese government.
* Threat actors use Tactics, Techniques, and Procedures (TTPs) consistent with Flax Typhoon, Ethereal Panda, and Red Juliett.
* Actors target edge devices that are not closely monitored by targeted organizations for long-term access.
* The advisory includes recommended actions to secure edge infrastructure, including patching known exploited common vulnerabilities and exposures (CVEs).
* Chinese government-linked cyber actors targeted critical infrastructure across sectors including government, critical manufacturing, healthcare, US law enforcement, and education organizations.

The narrative centers on the systemic entanglement of commercial technology providers with state-sponsored malicious activity targeting foundational societal systems. The pattern observed is the weaponization of legitimate infrastructure services—tools, hosting, and network access—to obscure the origin and scope of attacks against critical infrastructure. This shifts the locus of risk from purely adversarial nation-state conflicts to a pervasive supply chain vulnerability where commercial entities become unwitting or willing facilitators.
The implication here is that defense strategies must move beyond perimeter security to address the integrity of foundational operational technology (OT) systems, recognizing that control over the underlying digital and physical infrastructure is being contested by state actors using commercially available means. The invocation of named threat groups suggests an established pattern in adversary behavior; this implies a predictable, adaptable methodology for deep infiltration rather than isolated incidents.
The mechanism of relying on entities like Integrity Tech creates a complex dynamic: while organizations are urged to patch technical vulnerabilities (CVEs), the root problem involves systemic trust gaps regarding the software and services upon which critical functions rely. This invites reflection on where true sovereignty resides—in patching protocols, in corporate accountability, or in international governance structures capable of regulating these transnational enablers. What mechanisms exist for auditing the provenance of infrastructure used by critical sectors, beyond simple vulnerability management?