U.S. and allied cybersecurity agencies have publicly identified China-based Integrity Technology Group as an alleged enabler of cyber activity that has reached government agencies, critical manufacturing, healthcare, information technology and other organizations around the world. The unusually detailed joint alert names the company, describes tools and infrastructure tied to the activity, and asks organizations to hunt for compromise and strengthen exposed systems.
The October 8 advisory, led by the FBI, CISA and the NSA with partners in the United Kingdom, Australia, Canada, Japan, New Zealand and Spain, says its findings draw on technical evidence recovered during multiple FBI investigations. Its importance lies less in a new malware name than in the picture it builds of an operation combining automated scanning and credential attacks with more patient, hands-on access to steal sensitive data.
Company named as an alleged operational enabler
The agencies describe Integrity Technology Group as a for-profit Chinese company with links to the Chinese government. In their assessment, it acquires or develops hacking tools, hosts infrastructure and compromises networks for China-linked actors operating against victims internationally.
Those are government assessments, rather than independently adjudicated findings, and the advisory is careful in some of its other attribution language. It says the observed activity is consistent with campaigns publicly tracked under the names Flax Typhoon, Ethereal Panda and Red Juliett. But it explicitly does not treat those labels as interchangeable with Integrity Technology Group-enabled operations: actors associated with those clusters may conduct activity outside the company’s reported role, and the company-linked activity may not map neatly to any one cluster.
The victim list is broad. The advisory cites U.S. government services and facilities, critical manufacturing, healthcare and public health, information technology, law enforcement, education and religious organizations. It also identifies affected organizations in Southeast Asia, Africa and North America. The primary documents do not characterize Southeast Asia as the principal target region, despite a later SC Media follow-up emphasizing that geography.
That same brief called Integrity Technology Group sanctioned. Neither the advisory nor CISA’s accompanying announcement states that the company is sanctioned, so that description cannot be established from the available official material.
A layered route from scanning to email theft
The advisory describes an intrusion pattern built from familiar components rather than a single exotic exploit. Actors scanned for exposed systems, used botnets and VPN infrastructure at scale, then relied on command-line utilities and other living-off-the-land methods after gaining access. Such tools can blend into ordinary administrative activity, making them harder to distinguish from legitimate work without strong logging and account monitoring.
One tool highlighted in the report is MicroScan, a malicious web application the agencies say contains more than 1,300 penetration-testing scripts. The advisory says it was used as early as 2017. Since at least mid-January 2021, it says, the actors had principally gained access to victim networks and cloud services through command-line utilities based on exploit code.
The credential-access component is also notable. The agencies say a Python-based tool called EBurst was used for password spraying and password guessing against Microsoft Exchange and Microsoft 365-related interfaces. Password spraying tests a small number of common passwords across many accounts, seeking to avoid the account lockouts that can accompany repeated guesses against one user. That makes multifactor authentication, rate limits and alerts for abnormal sign-in patterns practical defensive priorities, as the advisory recommends.
Once inside, the actors used SoftEther VPN client software to maintain remote access, according to the report. It also documents scripts used to gather and exfiltrate email. In one XSS-related campaign, the FBI assessed that a recovered executable likely sought user email data for removal from the victim environment. The technical detail suggests an operation designed not merely to obtain an initial foothold but to retain it long enough to search communications and cloud-connected services.
Defenders get indicators, but not a simple fix
CISA’s separate release announcement urges organizations, especially critical-infrastructure operators, to review the technical alert, search for signs of compromise and apply its mitigations. The advisory provides indicators and detection guidance for security teams, but those materials are not a substitute for examining identity systems, remote-access paths and endpoint activity in context.
Its recommendations include applying patches, reducing unnecessary exposure of internet-facing services, enforcing multifactor authentication, monitoring for suspicious use of remote-management tools, and reviewing logs for anomalous account and network behavior. Organizations that use Microsoft 365 or on-premises Exchange face a particularly direct question: whether authentication logs, administrative activity and mailbox-access records can reveal low-and-slow credential attacks or unusual data collection.
The warning also reflects a shift in what public attribution can accomplish. Naming a company alleged to supply tooling and infrastructure moves the focus beyond a familiar threat-group label toward the commercial support system that can sustain repeated intrusions. For network operators, however, the immediate task remains less geopolitical: identify exposed services, examine suspicious authentication activity and determine whether an attacker is already using legitimate-looking tools inside the environment.
