China-based Integrity Tech enabled cyber actors to compromise networks worldwide, advisory says
The UK's National Cyber Security Centre issued the warning with eight international partners, saying the actors use AI tools, large-scale botnets and manual exploitation to steal confidential data.
AI illustrationIntegrity Technology Group (Integrity Tech), a company based in China, has enabled malicious cyber actors linked to China to compromise the networks of organisations worldwide, according to a joint advisory from the UK's National Cyber Security Centre (NCSC) and eight international partners from six countries.
Agencies from Australia, Canada, Japan, New Zealand, Spain and the United States joined the NCSC, which is part of GCHQ, in issuing the advisory. The NCSC said Integrity Tech has links to the Chinese government.
According to the NCSC, the actors that Integrity Tech enables combine AI tools, such as automated scanning, with large-scale botnets and manual exploitation techniques. They use this mix to compromise networks and steal confidential data from companies around the world, including in critical sectors.
The advisory also says the company employs people who support a range of malicious cyber activity and add to China's wider cyber ecosystem. This includes developing tools to use and to sell, acquiring and hosting infrastructure, and compromising networks across the world. The NCSC said the activity in the advisory is reported to be consistent with campaigns that are publicly known by other names, among them Flax Typhoon, Ethereal Panda and Red Juliett.
In September 2024, the NCSC and international partners exposed Integrity Tech as the operator of a substantial botnet, which the advanced persistent threat group Flax Typhoon used. A botnet is a network of malware-infected devices linked to the internet that are directed to launch cyber attacks. Last year, the UK government sanctioned Integrity Tech and another China-based information security company for their part in malicious cyber activity against the UK and its allies.
The NCSC said the malicious activity and services of Integrity Tech exposed in the advisory should deeply concern all network defenders, and that the range of sectors targeted around the world shows how far the threat extends. It urged all organisations to heed the warning, draw on its advice and guidance, understand the threat and the techniques these actors use, and follow the mitigation advice in the advisory. It also called on organisations to strengthen their cyber resilience against what it described as an evolving threat, and said it will keep exposing malicious actors and the ecosystem in which they operate.