US Agencies Warn of 58-Page Threat Report Linking ITG to China-Backed Attacks

Three major U.S. federal agencies issued a joint warning regarding coordinated cyberattacks linked to the Chinese government. The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the National Security Agency stated that threat actors are using compromised infrastructure to infiltrate networks worldwide. This advisory highlights the role of Integrity Technology Group in facilitating these intrusions into U.S. and foreign organizations.

Who is facilitating these cyberattacks?

According to the joint advisory, Integrity Technology Group is a China-based, for-profit company with established links to the Chinese government. The agencies identified this entity as a key enabler for hackers targeting multiple sectors, including U.S. critical infrastructure. Industrial Cyber reported that the advisory explicitly exposes the company’s role in these China-linked attacks on critical infrastructure systems globally.

The threat actors leverage the company’s resources to exploit networks across various industries. By combining legitimate software with specialized tools, these hackers maintain persistent access to compromised environments. The advisory notes that these operations are not isolated incidents but part of a broader strategy to steal sensitive data from organizations worldwide.

What tactics are the hackers using?

The agencies detailed a sophisticated mix of automated and manual techniques used by the attackers. These include automated reconnaissance, large-scale vulnerability scanning, and the use of botnets to identify weaknesses in internet-facing systems. The actors also employ hands-on hacking methods to bypass security controls and establish footholds within targeted networks.

Specific groups tracked as Flax Typhoon, Ethereal Panda, and Red Juliett are associated with these activities. The advisory states that these actors use tactics such as cross-site scripting attacks and password spraying to gain initial access. They then exploit vulnerabilities to move laterally within the network, aiming to exfiltrate email data and user credentials for future exploitation.

Why are critical infrastructure networks targeted?

Chris Butera, acting executive assistant director for cybersecurity at CISA, stated that these actors position themselves within critical infrastructure networks for future disruption. The goal is to embed themselves in operational technology systems to disrupt critical functions at a time of their choosing. This long-term strategy suggests that the current data theft is preparatory for more severe operational impacts later.

The advisory underscores the critical role of collaboration between government agencies and the private sector. By sharing indicators of compromise and documented tactics, the agencies aim to help organizations identify malicious activity early. This proactive approach is intended to mitigate exposure and protect sensitive information from ongoing China-linked cyber operations.

What should organizations do now?

The agencies urged organizations to review the full 58-page advisory for specific indicators of compromise. Security teams should hunt for evidence of unauthorized access within their networks, focusing on remote access points and account credentials. Strengthening defenses around internet-facing services is a primary recommendation to reduce the attack surface available to these threat actors.

Organizations are advised to implement the recommended actions and mitigations outlined in the report. This includes monitoring for signs of the specific tactics described, such as unusual VPN usage or scanning activity. Early detection and rapid response are essential to preventing the long-term persistence that these actors seek to establish.

What to do and how to stay safe: Integrity Technology Group

• Review the joint advisory for specific indicators of compromise and search your logs for matches.
• Audit all internet-facing services to ensure they are patched and access is strictly controlled.
• Enforce strong authentication protocols to mitigate the risk of password spraying attacks.
• Monitor network traffic for unusual outbound connections that may indicate data exfiltration.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which companies are linked to these attacks?

Integrity Technology Group, a China-based for-profit company with government links, is identified as enabling these attacks.

What sectors are being targeted?

The advisory states that organizations across multiple sectors, including U.S. critical infrastructure, are being targeted.

Is there a patch for these vulnerabilities?

The advisory urges organizations to strengthen defenses but does not confirm specific patches for all mentioned vulnerabilities.