> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide
- URL: https://f4n6.co.uk/security-feed/cisa-fbi-nsa-and-international-partners-warn-of-china-based-cybersecurity-company-enabling-threat-actors-to-target-multiple-critical-infrastructure-sectors-worldwide/
- Published: 2026-10-08T23:40:52.000Z
- Updated: 2026-10-08T23:40:52.000Z
- Author: Jeff Davies
- Tags: #security-feed, China-based Cybersecurity Company

## 1\. Executive summary

On 2026-10-08 CISA, the FBI, the NSA and international partners published a joint advisory naming Integrity Technology Group (Integrity Tech), a China-based cybersecurity company, as an enabler of threat activity against critical infrastructure in North America, Southeast Asia and Africa. The advisory states that Integrity Tech acquires or develops cyber tools, hosts infrastructure and compromises networks, and that the actors it enables use TTPs consistent with activity publicly tracked as Flax Typhoon, Ethereal Panda and Red Juliett. The named sectors are government, critical manufacturing, healthcare, US law enforcement and education; no EMEA victim is named in the source. The verified reference data carries no CISA KEV entries, no CVSS scores and no EPSS values for this item, and Integrity Tech has no MITRE ATT&CK profile, so the attribution to Chinese government direction is asserted by the issuing agencies and is unconfirmed by the reference data we hold. For EMEA financial services the exposure is indirect: the described tradecraft centres on edge devices that are poorly monitored, and the advisory's own mitigation list points at known exploited CVEs that the source does not enumerate.

## 2\. Regulatory framing

| Article                                                                 | Trigger (the fact in this item)                                                                                                                                                  | Practical impact                                                                                                                                                 |
| ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28: ICT third-party risk, general principles                  | The advisory names a commercial cybersecurity vendor as the enabler of intrusions against its customers' and others' networks, which puts vendor and supplier selection in scope | Firms should be able to evidence how they assess security vendors and hosting providers, and what contractual and monitoring controls sit behind that assessment |
| NIS2 Art. 21(2)(d): supply chain security measures                      | Same trigger: a named third-party company is the vector by which tooling and infrastructure reach victims                                                                        | Entities in scope need supply chain security measures covering their own vendors, not only their direct technology providers                                     |
| DORA Art. 30: key contractual provisions with ICT third-party providers | The advisory describes tooling and infrastructure supplied by a third party, which is the contractual relationship Art. 30 governs                                               | Review whether existing ICT contracts give audit, access and termination rights sufficient to act if a provider is implicated                                    |

No DORA incident-reporting article is engaged on the facts available: the source names no EMEA victim and no incident affecting an Adverse Trace client. If a client finds the described tradecraft in its own estate, DORA Art. 17, Art. 18 and Art. 19 and NIS2 Art. 23 become live at that point, not before.

## 3\. Technical analysis & attack chain

The source is a government announcement, not a technical report. It describes the enabling role and the broad tradecraft but publishes no CVEs, no hashes, no filenames, no command lines and no infrastructure. What follows is limited to what the source states.

1. Integrity Tech acquires or develops cyber tools and hosts infrastructure used by threat actors.
2. Those actors gain access to victim networks and maintain long-term, stealthy presence.
3. The access is held on edge devices that the victim organisation does not monitor closely.
4. The stated intent, per CISA's Acting Executive Assistant Director for Cybersecurity, is to position within critical infrastructure networks, including OT systems, to disrupt critical functions at a time of the actors' choosing.

The tooling categories named are large-scale botnets, VPN infrastructure and living off the land. Living off the land means the actors use binaries already present on the host rather than dropping custom malware, which is why the advisory's detection guidance leans on hunting rather than signature matching. The source does not name which binaries, which edge device models or firmware versions, or which VPN products are involved.

The TTPs are described as consistent with Flax Typhoon, Ethereal Panda and Red Juliett. The source does not map any of these to specific ATT&CK techniques, and the verified reference data holds no MITRE profile for Integrity Tech itself. Treat the three cluster names as the issuing agencies' own tracking labels; we cannot corroborate the technique-level overlap from the material supplied.

The advisory directs defenders to patch "the listed known exploited common vulnerabilities and exposures (CVEs)". The source does not list them. The verified reference data for this item contains no CVE identifiers, no CVSS scores and no CISA KEV entries. Any CVE list attributed to this advisory in secondary reporting should be checked against the joint advisory PDF before it is used for prioritisation.

Confidence caveats. The attribution of Integrity Tech to the Chinese government rests on the issuing agencies' statement ("with ties to the Chinese government") and is single-sourced to that joint advisory; the verified reference data provides no MITRE ATT&CK profile for the company, so we treat the state-direction claim as unconfirmed. The sector victim list (government, critical manufacturing, healthcare, US law enforcement, education) and the geographic spread (North America, Southeast Asia, Africa) are likewise single-sourced to the same announcement and contain no EMEA victim.

## 4\. Mitigation & containment

The source gives no vendor fix, no version numbers and no CVE identifiers, so the steps below are drawn from the tradecraft the advisory describes rather than from a patch list. Where a step depends on a CVE the source did not publish, we say so.

P1, within 24 hours

- Inventory every internet-facing edge device in the estate: VPN concentrators, firewalls, load balancers, remote-access gateways, out-of-band management interfaces. The advisory's central finding is that these are the devices victims do not watch. If the inventory does not exist, that gap is the finding.
- Confirm logging is on for those devices and that the logs reach the SIEM. Edge appliances frequently ship with minimal logging and no forwarding; an unmonitored appliance is the stated access path.
- Check for unauthorised local accounts, added administrative users, modified authentication config and unexpected firmware on those devices. The source does not name specific artefacts to look for, so this is a baseline review rather than an indicator match.
- Apply the vendor's current firmware to every edge device, and check the joint advisory PDF for the CVE list it references. Do not wait for that list to begin the inventory and logging work.

P2, within 72 hours

- Restrict management interfaces on edge devices to dedicated management networks or jump hosts. Management planes exposed to the internet are the condition the advisory describes.
- Enforce phishing-resistant MFA on VPN and remote access. The source names VPN infrastructure as an actor tool; credential abuse against remote access is the standard route in and MFA is the control that changes the outcome.
- Review third-party and vendor access paths into the network, including any security vendor with remote support capability. This is the supply chain angle the advisory raises and the one DORA Art. 28 and NIS2 Art. 21(2)(d) speak to.
- Hunt for living-off-the-land behaviour on servers and OT-adjacent hosts: native administrative binaries invoked from unusual parent processes, service creation by non-service accounts, and scheduled tasks created outside change windows. The source names living off the land explicitly; the specific binaries are not given.

P3, within 7 days

- Segment OT networks from corporate IT where that is not already done. The advisory states the actors position within OT to disrupt functions later; segmentation is the control that limits what a foothold in IT is worth.
- Add the edge device estate to the asset register with an owner, a firmware baseline and a review cadence. The advisory's finding is a monitoring gap, and a register is what closes it.
- Re-run the third-party risk assessment for security vendors and hosting providers against DORA Art. 28 and Art. 30 expectations, and record the outcome.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. The joint advisory announcement contains no hashes, domains, IP addresses, file paths, registry keys or command lines.

The source does describe observable behaviours. These are not atomic indicators and cannot be used for automated blocking; they are hunting leads.

### Behavioural indicators

| behaviour                                                             | where to observe                                                                       | confidence                                       |
| --------------------------------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------ |
| Long-term, stealthy access held on edge devices rather than endpoints | VPN concentrator, firewall and gateway authentication and configuration logs           | Stated in source; no artefact-level detail       |
| Use of large-scale botnets as an access or proxying layer             | Egress traffic from edge devices to unfamiliar destinations; proxy and netflow records | Stated in source; no infrastructure given        |
| Use of VPN infrastructure by the actors                               | VPN authentication logs, concurrent session counts, impossible-travel patterns         | Stated in source; no product or version given    |
| Living off the land, using native binaries instead of custom malware  | Endpoint and server process telemetry; parent-child process anomalies                  | Stated in source; no specific binaries named     |
| Positioning within OT networks for later disruption                   | OT network flow data, engineering workstation logs, PLC and HMI access records         | Stated in source; no OT-specific artefacts given |

## 6\. Detection

The source contains no distinctive strings, command-line flags, mutex names, scheduled-task names, file paths, registry keys or hard-coded values. It names tool categories and tracking labels, which are reporting about the activity rather than artefacts of it. A rule built on those strings would match the advisory text, not the intrusion.

Insufficient indicators to author detection rules.

Detection effort for this item should go into the behavioural hunts in §5 and the edge device logging work in §4, not into signature content.

## 7\. Sources

- CISA, "CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide", https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat, 2026-10-08
- NCSC UK, "China-linked malicious actors called out by UK and international partners for targeting sensitive data globally", https://www.ncsc.gov.uk/news/china-linked-actors-called-out-by-uk-and-international-partners-for-targeting-sensitive-data, date not stated in the supplied extract
- CISA, "CISA Joins NSA, FBI, DC3 and International Partners Warning of Russian Cyber Threat Activity Targeting Communications, Energy, Government and Other Critical Infrastructure Sectors", https://www.cisa.gov/news-events/news/cisa-joins-nsa-fbi-dc3-and-international-partners-warning-russian-cyber-threat-activity-targeting, date not stated in the supplied extract (related, different actor set)
- CISA, "CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors", https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-gunra-ransomware-actors-targeting-multiple-critical, date not stated in the supplied extract (related, different actor set)

## 8\. Adverse Trace position

We assess this as a medium-priority advisory for EMEA financial services clients, not an emergency. The source names no EMEA victim, publishes no CVE list, no CVSS scores and no indicators, and the verified reference data carries no CISA KEV entries for this item, so there is nothing here to drive an emergency patch cycle. The material risk is the one the advisory states plainly: edge devices that organisations do not monitor are where these actors sit, and most financial services estates have at least some of those. The attribution to Chinese government direction is asserted by the issuing agencies and is unconfirmed by the reference data we hold; we will not treat it as established. Our next steps are to obtain the full joint advisory PDF and extract the CVE list it references, then reissue this note with the specific exploited vulnerabilities and any indicators the PDF carries. Until that list is in hand, clients should treat the edge device inventory, logging and firmware review in §4 as the actionable content and should not prioritise against a CVE list sourced from secondary reporting.

---

[Read the original source →](https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*