· · · · ·

CISA, NSA and FBI Warn of China-Linked Data Theft Campaign

CISA, the NSA and the FBI said China-based Integrity Technology Group has enabled government-linked actors to steal email and other sensitive data.

ByPeter
Row of gold-mesh supercomputer cabinets along a tiled data-center floor
NASA Ames Research Center photograph

WASHINGTON — The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, the National Security Agency and international partners warned on Oct. 8, 2026, that a China-based company, Integrity Technology Group, is enabling Chinese government-linked cyber actors to steal sensitive data from organizations worldwide.

The joint cybersecurity advisory, AA26-281A, is based on technical evidence recovered from multiple FBI investigations related to Integrity Tech, CISA said. The National Security Agency, in a Fort Meade press release the same day, said the company “employs individuals who support malicious cyber activity in different ways, contributing to the larger Chinese cyber ecosystem that aims to exfiltrate sensitive data from victims around the world.”

Who the agencies named

CISA described Integrity Tech as a China-based for-profit company with links to the Chinese government. The advisory said the company supports malicious cyber activity by acquiring or building tools, acquiring and hosting infrastructure, and compromising networks. A CISA news release quoted FBI Cyber Division Assistant Director Brett Leatherman as saying that, under the bureau’s cyber strategy, investigators “pursue both the actors who threaten critical infrastructure and the enterprises that support them.”

The authoring organizations said Integrity Tech-enabled actors have targeted U.S. critical infrastructure sectors including government services and facilities, critical manufacturing, healthcare and public health, and information technology. They also said the actors targeted victims in U.S. law enforcement, education and religious organizations, as well as organizations in Southeast Asia, Africa and North America.

CISA and NSA said some of the malicious actors enabled by Integrity Tech use tactics consistent with activity publicly known as Flax Typhoon, Ethereal Panda and Red Juliett. The NSA press release also listed Storm 919. The advisory cautioned that cybersecurity companies track clusters differently and that those industry names “may not be a 1:1 correlation to the US Government’s methodology.”

Partners on the advisory included the United Kingdom’s National Cyber Security Centre, the Australian Signals Directorate’s Australian Cyber Security Centre, the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, New Zealand’s National Cyber Security Centre, and Spain’s Centro Nacional de Inteligencia.

How the actors operate

The advisory said the actors combine automated scanning, large-scale botnets and hands-on exploitation. CISA said they use open-source scanning tools to find vulnerabilities, conduct cross-site scripting attacks to harvest credentials, and use password spraying against Microsoft Exchange servers. To keep access, the actors install legitimate SoftEther virtual private network software on victim devices, often under names that resemble common Windows programs, the advisory said. They then collect email and credentials, including from cloud mailboxes.

CISA’s news release said the actors have targeted edge devices that are not closely monitored, in order to maintain long-term, stealthy access. The advisory lists several older vulnerabilities that investigations found had been successfully exploited, some of which CISA marked as additions to its Known Exploited Vulnerabilities catalog.

CISA’s China threat overview, which links the Integrity Tech advisory, said the Office of the Director of National Intelligence’s 2026 Annual Threat Assessment “highlights persistent cyber threats to U.S. government, private sector, and critical infrastructure networks posed by Chinese government-linked cyber actors.” The same CISA page said CISA, NSA and the FBI assess that such actors “are positioning themselves within information technology networks, enabling lateral movement to operational technology systems.”

In the news release accompanying the advisory, Acting Executive Assistant Director for Cybersecurity Chris Butera said: “Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing.”

What defenders are told to do

The agencies urged network defenders to hunt for signs of compromise and to apply listed mitigations, including disabling unused services and ports, sanitizing web-application input to block cross-site scripting, requiring multifactor authentication, replacing default passwords, segmenting networks, monitoring for unexpected Active Directory replication, and applying patches promptly.

CISA said organizations should review the advisory’s indicators of compromise and report suspicious activity to the FBI or to CISA.

What it means

Analysis: The advisory is unusual in naming a commercial company as an enabler of government-linked intrusions, rather than describing only an industry cluster name. The agencies present Integrity Tech as part of a broader ecosystem that supplies tools and infrastructure. They do not claim every intrusion associated with Flax Typhoon or the other industry names is the work of that company. The practical instruction for defenders is to treat poorly monitored edge devices, exposed services and weakly authenticated mail systems as the main openings described in the investigations.

Sources

Additional sources

Related coverage

Related on Peter’s World

Recommended articles