Actor Profile

Integrity Technology Group is a China-based for-profit cybersecurity company with documented links to the Chinese government. According to the FBI and six partner agencies, the company's employees develop and acquire cyber tools for use and sale, host infrastructure, and conduct network intrusions. The company's chairman publicly admitted that for years the firm collected intelligence and performed reconnaissance for Chinese government security agencies. Integrity Technology Group was sanctioned by the U.S. Treasury in January 2025 and by the UK in December 2025 for its role in computer intrusions against U.S. and allied victims. The company has rejected U.S. accusations as baseless. The actor's activity overlaps with multiple threat clusters tracked by security vendors as Flax Typhoon, Ethereal Panda, and RedJuliett, though these designations may not map one-to-one to government tracking.

TTPs (Tactics, Techniques, Procedures)

The actor employs vulnerability scanning and credential-based initial access techniques. They use open-source reconnaissance tools (Nmap, masscan, WPScan) and a proprietary Python scanner called MicroScan containing over 1,300 penetration testing scripts targeting ports 21, 22, 53, 80, 443, and 1080. Initial access is achieved through exploitation of known vulnerabilities (CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894) in services including OpenSSL, Oracle WebLogic, Rejetto HFS, WordPress, Juniper ScreenOS, Jenkins, Apache Struts, Pulse Connect Secure, GitLab, ONLYOFFICE, and Strapi. They conduct password guessing attacks against Microsoft 365 and Exchange accounts. Post-compromise, the actor uses specialized tools to copy entire mailboxes and exfiltrate email content. They operate a web application portal that provides third-party access to stolen email data, suggesting a data brokering or intelligence-sharing capability.

Targets & Patterns

The actor targets government organizations, law enforcement agencies, healthcare systems, and religious institutions across multiple regions. Primary targeting focuses on Southeast Asia, with additional victims in China, the United States, the United Kingdom, Africa, and North America. Within the U.S., the actor has targeted government services, critical manufacturing, healthcare, IT organizations, law enforcement, education, and religious groups. The targeting pattern suggests intelligence collection objectives aligned with Chinese government interests, particularly focused on government and law enforcement entities that would yield strategic intelligence. The breadth of sectors—spanning critical infrastructure, healthcare, education, and religious organizations—indicates comprehensive intelligence gathering rather than narrowly focused espionage. The actor's operation of a portal providing third-party access to stolen emails suggests they may function as an intelligence broker or contractor serving multiple clients.

Historical Context

Integrity Technology Group's intrusion activity dates back to at least mid-January 2021 according to the joint advisory, though their MicroScan tool has been in use since at least 2017. In September 2024, the FBI disrupted a botnet controlled by the company, dubbed Raptor Train by Lumen researchers, which comprised over 200,000 hijacked routers, cameras, and consumer devices. That 2024 action addressed the botnet infrastructure, while the October 2026 advisory focuses on network intrusion and data theft operations. The activity overlaps with Flax Typhoon, which Microsoft identified in 2023 as targeting organizations in Taiwan. The U.S. Treasury sanctioned the company in January 2025, followed by UK sanctions in December 2025. The October 2026 disclosure represents a coordinated attribution by the FBI and six partner countries, marking an escalation in public attribution and information sharing about the actor's email theft operations.

Defensive Recommendations

  • Prioritize patching of the eight CVEs identified in the advisory (CVE-2014-6278, CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2019-11510, CVE-2021-22205, CVE-2021-3199, CVE-2023-22894), particularly in internet-facing services including Apache Struts, GitLab, Pulse Connect Secure, ONLYOFFICE, and Strapi
  • Monitor and restrict inbound scanning activity targeting ports 21, 22, 53, 80, 443, and 1080; implement rate limiting and anomaly detection for reconnaissance behavior consistent with Nmap, masscan, and WPScan
  • Enforce multi-factor authentication (MFA) on all Microsoft 365 and Exchange accounts to mitigate password guessing attacks; monitor for unusual authentication patterns and failed login attempts
  • Deploy detection rules for bulk mailbox export operations and unusual email access patterns; monitor for use of mail collection tools and large-scale data exfiltration from email systems
  • Conduct threat hunting for indicators of MicroScan Python-based scanning tools and command-line exploitation tools written in Python and Go; review web server logs for exploitation attempts against the identified vulnerable services

---

# Geopolitical Context

Geopolitical Context

The joint advisory from the FBI and six partner nations represents a coordinated effort to publicly attribute sustained cyber espionage operations to Integrity Technology Group, a Chinese cybersecurity company described as having links to the Chinese government. The disclosure follows a pattern of Western governments naming and sanctioning Chinese commercial entities alleged to conduct intelligence collection on behalf of state security agencies. The targeting of government organizations, law enforcement, healthcare, and religious institutions across Southeast Asia, Africa, and North America is consistent with broad intelligence-gathering objectives. The operation's infrastructure—including a web portal providing third-party access to stolen emails—suggests a commercialized model where collected intelligence may be distributed beyond the immediate operators. This aligns with assessments that some Chinese cyber actors operate in a gray zone between state direction and private profit. The timing of the advisory, following earlier botnet disruption in 2024 and successive U.S. and UK sanctions in 2025, indicates an escalating Western response to persistent intrusion activity attributed to this actor.

State Actor Alignment

Integrity Technology Group is characterized by the joint advisory as "a China-based for-profit company with links to the Chinese government." Former FBI Director Christopher Wray stated in 2024 that the company's chairman publicly acknowledged collecting intelligence and performing reconnaissance for Chinese government security agencies. The U.S. Treasury sanctioned the company in January 2025 for its role in intrusions against U.S. victims; the UK imposed sanctions in December 2025. The activity is assessed as consistent with threat clusters tracked by private sector firms as Flax Typhoon, Ethereal Panda, and RedJuliett. China's Foreign Ministry rejected the U.S. accusations, and Integrity Technology Group told the Shanghai Stock Exchange the sanctions had no factual basis. The advisory does not distinguish operationally between company employees and enabled third parties, referring collectively to "the threat actors." The provision of stolen email access to unidentified third parties suggests a potential intelligence-sharing or commercialization arrangement that may extend beyond direct state tasking.

Business Impacty pro region

The targeting pattern reflects strategic interest in Southeast Asian governance, law enforcement, and civil society, regions where China seeks to expand influence and monitor dissent. Healthcare and religious institution targeting may indicate interest in social stability, ethnic minority monitoring, or pandemic-related intelligence. The inclusion of African and North American victims suggests global operational reach. For European partners, the joint advisory—issued with UK participation and NCSC technical contribution—reinforces transatlantic coordination on China-linked cyber threats and sanctions policy. The UK's emphasis on "AI tools, such as automated scanning" in its release may signal European concern over emerging capabilities, though the advisory itself does not elaborate on AI use. Southeast Asian nations face pressure to balance cybersecurity cooperation with Western partners against economic and diplomatic ties with Beijing. The disclosure may complicate regional technology procurement decisions and trust in Chinese cybersecurity vendors. The botnet disruption in 2024, which commandeered over 200,000 consumer devices globally, underscores the collateral impact on civilian infrastructure in multiple jurisdictions.

Forecast

If Western governments continue coordinated attribution and sanctions against Chinese commercial cyber actors, Beijing is likely to maintain its pattern of denial and characterize such actions as politically motivated. Integrity Technology Group's operations may adapt through infrastructure changes, but the company's public exposure and sanctions will likely constrain its international business relationships. If the unidentified third parties receiving stolen email access include other state or non-state actors, further disclosures could emerge as investigations progress, potentially broadening the diplomatic and legal response. Southeast Asian governments may face increased pressure to harden defenses and scrutinize Chinese technology vendors, though economic dependencies may limit policy shifts. If the hackers continue exploiting older vulnerabilities—some dating to 2014—organizations that have not applied patches from the past decade remain at elevated risk. The advisory's focus on open-source tooling and known exploits suggests that basic cyber hygiene measures, if implemented, could significantly reduce exposure to this threat actor. Continued FBI and partner nation investigations may yield additional technical indicators or victim notifications in the coming months.