Actor Profile

China-linked malicious cyber actors enabled by Integrity Technology Group (Integrity Tech), a China-based company with links to the Chinese Government. The company was sanctioned by the UK government in 2025 for malicious cyber activity against the UK and its allies. Integrity Tech employs individuals who support a range of malicious cyber activities, develop tools for use and sale, acquire and host infrastructure, and compromise networks globally. The activity is consistent with campaigns publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett. Integrity Tech was previously exposed in September 2024 as the operator of a substantial botnet utilized by the advanced persistent threat group Flax Typhoon.

TTPs (Tactics, Techniques, Procedures)

The actors employ a hybrid approach combining automated and manual techniques. Key TTPs include: AI-enabled automated scanning for reconnaissance and vulnerability identification; deployment and operation of large-scale botnets for distributed attacks and infrastructure; hands-on manual exploitation techniques for network compromise; and exfiltration of confidential and sensitive data from compromised organizations. The threat actors leverage infrastructure acquired and hosted by Integrity Tech, utilizing both custom-developed tools and commercially available capabilities. The botnet infrastructure enables covert network operations across multiple sectors and geographies simultaneously.

Targets & Patterns

The actors target organizations across multiple sectors globally, with particular focus on critical infrastructure sectors. Victims span the United Kingdom, China, and organizations worldwide across diverse industries. The breadth of targeted sectors demonstrates an indiscriminate approach aimed at collecting sensitive data from a wide range of organizations rather than focusing on specific verticals. The global scope and multi-sector targeting pattern suggests intelligence collection objectives consistent with state-sponsored espionage operations. The use of Integrity Tech as an enabler provides the actors with scalable infrastructure and tooling to conduct operations at significant scale across international boundaries.

Historical Context

This advisory builds on previous international disclosures regarding Integrity Tech's malicious activities. In September 2024, the NCSC and international partners exposed Integrity Tech as the operator of a substantial botnet utilized by the APT group Flax Typhoon. In 2025, the UK government sanctioned Integrity Tech alongside another China-based information security company for malicious cyber activity against the UK and allies. Earlier in 2026, the NCSC and 15 international partners from nine countries issued guidance on defending against covert networks. The current advisory represents coordinated attribution from the UK and eight international partners across six countries, demonstrating sustained international focus on this threat ecosystem. The activity links to multiple publicly tracked campaigns including Flax Typhoon, Ethereal Panda, and Red Juliett.

Defensive Recommendations

  • Review and implement NCSC guidance on defending against covert networks and botnet infrastructure, with particular attention to detecting compromised devices within your network perimeter
  • Deploy enhanced monitoring for AI-enabled automated scanning activity, including unusual patterns of vulnerability probing and reconnaissance against internet-facing assets
  • Strengthen detection capabilities for both automated and manual exploitation techniques by correlating automated scanning events with subsequent hands-on keyboard activity
  • Implement data loss prevention controls and egress filtering to detect and prevent exfiltration of confidential data, particularly from critical sectors and sensitive systems
  • Engage with the joint advisory available on the FBI website (https://www.ic3.gov/CSA/2026/261008.pdf) to understand specific indicators of compromise and mitigation measures relevant to your organization's threat profile

---

# Geopolitical Context

Geopolitical Context

The joint advisory represents a coordinated international effort to publicly attribute malicious cyber activity to Integrity Technology Group, a China-based company with reported links to the Chinese Government. This attribution follows a September 2024 exposure of the company's role in operating a substantial botnet associated with the Flax Typhoon advanced persistent threat group. The advisory, issued by agencies from seven countries (UK, US, Australia, Canada, Japan, New Zealand, and Spain), signals a sustained Western strategy of naming and shaming state-linked cyber actors to impose reputational costs and disrupt operations. The targeting of critical sectors globally reflects broader strategic competition between China and Western allies over technological advantage and sensitive data access. The UK's prior sanctions against Integrity Tech in 2025 underscore the escalation from technical attribution to economic countermeasures, positioning cyber activity within the wider framework of geopolitical rivalry and technology security.

State Actor Alignment

Integrity Technology Group is described as having "links to the Chinese Government" and enabling "malicious China-linked cyber actors." The UK government sanctioned Integrity Tech in 2025 for "heedless malicious cyber activity against the UK and its allies." The advisory notes the company employs individuals who "support a range of malicious cyber activities and contribute to the wider Chinese cyber ecosystem," including tool development, infrastructure acquisition, and network compromise. The activity is reported as consistent with campaigns publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett. The coordinated attribution by seven nations—UK, US, Australia, Canada, Japan, New Zealand, and Spain—reflects a collective assessment of state nexus and represents a diplomatic signal of shared concern over China-linked cyber operations targeting sensitive data across multiple sectors globally.

Business Impacty pro region

The advisory's issuance by agencies spanning Europe (UK, Spain), North America (US, Canada), and Asia-Pacific (Australia, New Zealand, Japan) underscores the global scope of the threat and the breadth of allied coordination. For European nations, the targeting of critical sectors reinforces concerns about economic espionage and the security of sensitive infrastructure, particularly as the EU seeks to reduce dependencies on Chinese technology. The UK's leadership role, including prior sanctions, positions London as a key voice in transatlantic cyber policy coordination. Asia-Pacific partners' participation signals regional anxiety over China's cyber capabilities and willingness to align with Western attribution efforts despite economic interdependencies. The advisory's emphasis on AI-enabled tools and large-scale botnets highlights the evolving technical sophistication of state-linked actors, prompting calls for enhanced collective defense mechanisms, information sharing, and potential expansion of coordinated sanctions regimes across allied nations.

Forecast

If Integrity Technology Group continues operations despite international exposure and UK sanctions, allied nations may expand coordinated countermeasures, including additional sanctions designations, indictments, or technical disruptions of associated infrastructure. Should the company adapt its tactics or rebrand to evade attribution, defenders are likely to face persistent targeting with evolving AI-enabled and botnet-driven techniques, necessitating sustained vigilance and mitigation efforts. If China-linked actors shift to alternative service providers within the broader Chinese cyber ecosystem, the threat to critical sectors globally is likely to persist, potentially prompting further joint advisories and attribution efforts. Conversely, if the reputational and economic costs of exposure lead to operational constraints on Integrity Tech, there may be a temporary reduction in activity associated with known campaigns such as Flax Typhoon, though displacement to other actors remains probable. The advisory's emphasis on defense measures suggests that if organizations fail to implement recommended mitigations, successful compromises and data theft are likely to continue across targeted sectors.