The UK’s National Cyber Security Centre has joined with the Five Eyes international collaboration for cybersecurity to call out the malicious cyber acvitities enabled by a seemingly legitiate China-linked technology firm.

The NCSC has issued a new advisory with the Five Eyes revealing how Integrity Technology Group, a China-based company with links to the Chinese Government, has enabled malicious China-linked cyber actions to exploit and compromise networks belonging to organisations across the globe.

Malicious cyber actors, allegedly enabled by Integrity Tech, are uniquely using AI tools, such as automated scanning, alongside large-scale botnets and manual exploitation techniques to compromise and steal confidential data from companies around the world, including critical sectors.

Last year, the UK government sanctioned Integrity Tech, alongside another China-based information security company for their part in malicious cyber activity against the UK and its allies.

The advisory also highlights that the company employs individuals who support a range of malicious cyber activities and contribute to the wider Chinese cyber ecosystem, including developing tools for use and sale, acquiring and hosting infrastructure and compromising networks across the globe.

The activity in the advisory is reported to be consistent with campaigns also publicly known as Flax Typhoon, Ethereal Panda and Red Juliett among others.

“The extensive malicious cyber activities, and services by Integrity Tech, that have been exposed today should be extremely concerning for all network defenders,” Paul Chichester, NCSC Director of Operations.

“The breadth of sectors that have been targeted across the globe demonstrate the extent of the threat and all organisations should take note of this warning and engage with NCSC advice and guidance.

“We will continue to call out malicious actors and the malevolent ecosystem they operate in.”

Organisations are being urged to understand the threat and techniques used by these cyber actors and follow the mitigation advice to helpful defend against the activity highlighted in the advisory.

Recommended reading

• 65% of Cyber-leaders Reuse Old Passwords
• NCSC Warns of Russian Zero-click Exploit Campaign
• NCSC Warns of Covert China-linked Networks
• NCSC Endorses Passkeys Over Passwords
• World Password Day: Are Passkeys the Future?
• Kaspersky: 45% of Passwords Could be Hacked Within 1 Minute

In September 2024, the NCSC alongside international partners, exposed Integrity Tech as the operator of a substantial botnet, where a network of internet-connected devices are infected with malware and controlled to carry out cyber attacks, and was utilised by advanced persistent threat group, Flax Typhoon.

Earlier this year, the NCSC alongside industry and 15 international partners from across nine countries issued an advisory and guidance highlighting how organisations can better defend against the cyber threat from covert networks.

The NCSC has co-sealed this new advisory alongside agencies from Australia, Canada, Japan, New Zealand, Spain and the United States.