The UK’s National Cyber Security Centre (NCSC), the FBI, and partners in Australia, Canada, Japan, New Zealand, Spain, and the US issued a joint advisory on 8 October calling out Integrity Technology Group (Integrity Tech), a China-based company that the NCSC says has links to the Chinese Government, for enabling cyber attacks on organisations worldwide. The FBI also seized websites behind two of its tools.
What happened
- The advisory says Integrity Tech staff develop tools for use and sale, run attack infrastructure, and compromise networks, combining AI-enabled scanning, botnets, and manual exploitation. The activity is consistent with the group known as Flax Typhoon.
- The FBI seized domains behind the company’s MicroScan scanning tool and FishHub phishing platform. Reported targets include airports in Japan and Poland, a US power company, and energy firms and universities in Taiwan.
- CISA added five older vulnerabilities used in the activity, in ProFTPD, BIND, Apache Struts, ONLYOFFICE, and Strapi, to its Known Exploited Vulnerabilities catalogue.
- The UK had already sanctioned Integrity Tech, and in 2024 the NCSC and partners exposed it as the operator of a botnet used by Flax Typhoon.
Why it mattered
The action targets the commercial contractors that supply state-linked hackers, not just the hackers themselves. The NCSC’s Director of Operations, Paul Chichester, said the activity should be extremely concerning for all network defenders.
Lessons for organisations
Old, unpatched internet-facing systems remain an easy way in. Keep an inventory of edge devices and exposed services, patch or retire legacy software, use MFA on webmail and VPNs, and check your systems against the advisory’s indicators of compromise.
Source: NCSC and The Record
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
