Chinese government-linked cyber threat actors are targeting organizations worldwide, including critical US infrastructure, to steal sensitive data using automated scanning tools, large botnets and hands on hacking techniques to steal sensitive data, according to a joint cybersecurity advisory issued on October 8.
The advisory led by the US Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA), said the activity is enabled by Integrity Technology Group, a China-based company linked to the Chinese government.
Today, the NCSC and international partners has exposed how China-linked company, Integrity Technology Group, has enabled malicious cyber activity worldwide.
Organizations are urged to read the new advisory to understand the threat and techniques.
https://t.co/BNn3JThKyt— NCSC UK (@NCSC) October 8, 2026
“Malicious cyber actors, enabled by Integrity Tech, are uniquely using AI tools, such as automated scanning, alongside large-scale botnets and manual exploitation techniques to compromise and steal confidential data from companies around the world, including critical sectors,” the joint advisory read.
The advisory was issued by US and international cybersecurity agencies, including the UK National Cyber Security Centre, the Australian Signals Directorate’s Australian Cyber Security Centre and cybersecurity authorities in Canada, Japan and New Zealand.
Integrity Tech has enabled Chinese government-linked threat actors to exploit organizations’ networks globally and exfiltrate critical data. We’ve joined @FBICyberDiv and others to arm organizations with guidance to proactively defend their networks from this threat. https://t.co/m5bs1MCPvT
— NSA Cyber (@NSACyber) October 8, 2026
The attackers have targeted government agencies, critical manufacturing, healthcare, IT, law enforcement, education and religious organizations. Victims have been identified in Southeast Asia, Africa and North America.
The advisory has highlighted that the company Integrity Technology Group employs individuals who support a range of malicious cyber activities and contribute to the wider Chinese cyber ecosystem, including developing tools for use and sale, acquiring and hosting infrastructure and compromising networks across the globe.
According to the advisory, the attackers exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts.
The FBI found that the attackers used a tool called DC.exe to extract sensitive Active Directory information, including account credentials, group memberships and trust relationships. In some cases, access to stolen data was restricted to IP addresses in Xiamen, China.
The advisory said the activity is consistent with techniques associated with cyber groups known as Flax Typhoon, Ethereal Panda and Red Juliett, while cautioning that these links may not correspond directly to the groups’ classifications by different cybersecurity organizations.
The agencies urged organizations to apply security patches, enable multifactor authentication, replace default passwords, restrict administrative access and monitor unusual network traffic and account activity. They also recommended disabling unused services and ports and securing web applications against attacks.
In September 2024, the National cybersecurity centre UK (NCSC) alongside international partners, exposed Integrity Tech as the operator of a substantial
botnet, where a network of internet-connected devices are infected with malware and controlled to carry out cyber attacks, and was utilized by advanced persistent threat group, Flax Typhoon.
Meanwhile, Chinese Foreign Ministry spokesperson Mao Ning on Friday rejected US allegations of Chinese hacking, saying China opposes cyberattacks and spread of false information for political purposes, according to Global Times.
Responding to reports that the US Justice Department was seizing seven internet domains allegedly linked to Chinese hackers targeting critical infrastructure, Mao urged Washington to abandon double standards and political manipulation and work with Beijing through dialogue to address cybersecurity risks.
Also Read: China AI Boom: How is China Financing it? What a US-Based Research Firm Says
