Loading story…
The UK National Cyber Security Centre (NCSC) and eight international partners issued an advisory on 8 October 2026 exposing global cyber espionage enabled by China-based Integrity Technology Group, which has links to the Chinese government. China-linked actors used AI-enabled automated scanning, large-scale botnets and manual exploitation to compromise organisations and steal sensitive data, including from critical sectors. Integrity Tech personnel supported these operations through tool development, infrastructure acquisition and hosting, and network compromise. The reported activity is consistent with campaigns publicly known as Flax Typhoon, Ethereal Panda and Red Juliett, among others.
The disclosure follows UK sanctions imposed in December 2025 on Integrity Tech and Sichuan Anxun Information Technology, known as i-Soon. The UK said Integrity Tech managed a covert cyber network and assisted attacks, including against UK public-sector IT systems, while i-Soon targeted more than 80 government and private-sector systems worldwide. The NCSC assessed it was almost certain that a broader Chinese private-sector ecosystem of security firms, data brokers and hackers for hire supports Chinese state-linked operations. These actions build on an August 2025 joint exposure of three other China-based companies linked to SALT TYPHOON. The NCSC urged organisations to implement the latest advisory’s mitigation guidance and strengthen cyber resilience.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
Gurucul published a report providing domain, IP address and file-hash indicators for Chinese government-linked attacks enabled by Integrity Technology Group. It included detection queries for domain and URL fields, source and destination IP addresses, and MD5 and SHA-256 hashes.
The NCSC and eight international partners issued an advisory detailing how Integrity Tech enables China-linked actors to compromise networks using AI-enabled scanning, large-scale botnets and manual exploitation. The advisory described sensitive-data theft across multiple sectors and activity consistent with Flax Typhoon, Ethereal Panda and Red Juliett, alongside Integrity Tech personnel’s role in tool development, infrastructure provision and network compromise.
The article reports that Xu Zewei, a co-defendant in the case involving Zhang Yu, was extradited from Italy to the United States to face charges involving alleged theft of COVID-19 research from U.S. universities and immunology and virology researchers.
The European Union imposed sanctions on Integrity Technology Group, also known as Integrity Tech.
The NCSC, industry and 15 international partners across nine countries issued guidance on defending against cyber threats from covert networks.
The UK sanctioned i-Soon and Integrity Tech, stating that i-Soon targeted more than 80 government and private-sector IT systems worldwide. It said Integrity Tech managed a covert cyber network and provided technical assistance for cyberattacks, including against UK public-sector IT systems.
The UK and partners from 12 other countries issued an advisory linking Sichuan Juxinhe, Beijing Huanyu Tianqiong and Sichuan Zhixin Ruije to SALT TYPHOON cyber-espionage. The activity targeted government, telecommunications, transportation and military infrastructure globally to enable Chinese intelligence services to track targets’ communications and movements.
The United States imposed sanctions on Integrity Technology Group for facilitating hacking operations.
The FBI disrupted the Raptor Train botnet, which contained more than 200,000 hijacked routers, cameras and other consumer devices. The U.S. Justice Department attributed the botnet to Integrity Technology Group.
The NCSC and international partners exposed Integrity Tech as the operator of a substantial botnet of malware-infected internet-connected devices. The advanced persistent threat group Flax Typhoon used the botnet to conduct cyberattacks.
The U.S. State Department announced a reward of up to $10 million for information leading to the identification or location of Chinese national Zhang Yu. He was charged in connection with the 2021 Microsoft Exchange Server attacks attributed to Silk Typhoon, formerly Hafnium.
CISA added CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199 and CVE-2023-22894 to its Known Exploited Vulnerabilities Catalog based on reported activity by Chinese government-linked attackers enabled by Integrity Technology Group.
Unsealed U.S. court documents identified alleged Integrity Technology Group targets including a South Carolina power company, airports in Japan and Poland, Taiwanese natural gas and power companies, and a multinational nongovernmental organization. These disclosures broadened the identified targeting beyond the previously reported Taiwanese universities.
The U.S. Justice Department and FBI seized six internet domains supporting Integrity Tech’s Microscan and FishHub tools, which enabled vulnerability reconnaissance, phishing, malware delivery, remote access and file theft. Prosecutors identified approximately 20 Taiwanese universities as confirmed victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 310 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
24 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcesecurityaffairs.com
Open sourceinfosecurity-magazine.com
Open sourceitpro.com
Open sourcencsc.gov.uk
Open sourcebankinfosecurity.com
Open sourcegov.uk
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from the UK **NCSC**, the United States, and other international partners warned that China-nexus threat actors are increasingly using large covert networks of compromised **SOHO routers, IoT devices, firewalls, and NAS systems** to route malicious traffic, hide attribution, and support espionage and disruptive operations. The warning said these botnet-style proxy networks are used across the full cyber kill chain, from reconnaissance and malware delivery to command-and-control and data theft, and identified activity tied to **Volt Typhoon**, **Flax Typhoon**, and the **Raptor Train** botnet. Officials said Volt Typhoon’s **KV Botnet** relied heavily on end-of-life Cisco and Netgear routers, while Raptor Train infected more than **200,000** devices worldwide and was reportedly controlled by **Integrity Technology Group**. Governments said the scale and churn of these compromised-device networks make traditional static IP blocklists increasingly ineffective, creating what some reporting described as rapid indicator loss or “IOC extinction.” Agencies urged organizations to map internet-facing and edge assets, baseline normal traffic from routers and IoT devices, enforce **MFA**, apply dynamic threat intelligence, use allow-listing and **zero trust** controls, and actively hunt for suspicious proxy-node behavior on residential, branch, and enterprise-connected infrastructure. The disclosures also linked the threat to broader Chinese pre-positioning activity against critical infrastructure and telecom environments, underscoring how weakly secured edge devices continue to provide durable operational cover for state-backed intrusions.
Jun 29, 2026
Reporting indicates **China-linked intelligence activity** is targeting current and former Western government officials through both human and technical collection. In the US case, a suspected Chinese influence/collection network using a purported consultancy (*Foresight and Strategy*) allegedly approached a former senior State Department official and offered payment to produce an assessment of US policy priorities in Venezuela, consistent with prior research describing a nexus of fake companies and websites used to recruit people with government and think-tank policy experience. In the UK, Chinese state-linked hackers are accused of maintaining years-long access to communications associated with senior Downing Street officials, with reporting alleging compromises affecting phones used by aides to former prime ministers **Boris Johnson, Liz Truss, and Rishi Sunak** dating back to 2021 and discovered in 2024. The activity has been linked by sources to **Salt Typhoon**, a China-aligned espionage group associated with telecom-provider intrusions that can enable collection of call metadata and potentially content (texts/calls), allowing intelligence value even without direct handset malware.
Jun 29, 2026
SentinelLABS disrupted multiple China-nexus cyberespionage campaigns between June 2024 and March 2025 targeting SentinelOne, a South Asian government entity, a European media organization, and more than 70 other victims. The ShadowPad and PurpleHaze clusters used chained zero-days in edge appliances, including `CVE-2024-8963` and `CVE-2024-8190`, alongside ShadowPad malware protected by ScatterBrain/ScatterBee obfuscation, the Go-based GOREshell reverse-SSH backdoor, Nimbo-C2, operational relay box networks, and log removal. SentinelOne reported that it was not compromised. A joint Tenable-SentinelOne review shows that this activity reflects a broader cross-actor pattern: 93 CVE-to-actor attribution pairs across 82 vulnerabilities converged on all seven identified edge-device vendors, despite only 21% overlap in the CVEs tracked independently. Twelve flaws have confirmed exploitation by multiple China-, Russia-, DPRK-, or Iran-linked groups and ransomware operators. F5, Citrix, and Ivanti EPMM and Connect Secure deployments face recurring exposure and exploitation; organizations should prioritize edge-device patching, disable unnecessary features, continuously monitor remote-access systems, and use segmentation and other defense-in-depth controls to limit lateral movement after a breach.
Aug 26, 2026