US agencies warn Integrity Tech supports attacks on critical infrastructure

CISA, the FBI, the NSA and international partners issued a joint advisory warning that China-based Integrity Technology Group, also called Integrity Tech, enables threat actors targeting critical-infrastructure sectors around the world. The agencies based the warning on investigations and observed activity in North America, Southeast Asia and Africa.

According to the advisory, Integrity Tech acquires or develops cyber tools, hosts infrastructure and compromises networks. The supported activity includes large botnets, virtual private network infrastructure and “living off the land,” a technique that uses legitimate tools already present on a system to avoid standing out.

Why edge devices matter

The agencies say the associated actors pursue long-term, quiet access through edge devices that organizations may not monitor closely. The observed targets included government, critical manufacturing, healthcare, US law-enforcement and education organizations, while the activity was consistent with groups publicly known as Flax Typhoon, Ethereal Panda and Red Juliett.

CISA, the FBI and their partners urge organizations—especially critical-infrastructure operators—to read the advisory, hunt for signs of compromise and apply its mitigations, including patches for the listed exploited vulnerabilities. The advisory documents malicious activity and defensive steps; it does not establish that every organization using an affected edge product was compromised.