Joint advisory names China-based Integrity Tech as an enabler of attacks on critical infrastructure

CISA, the FBI, NSA and international partners issued a joint Cybersecurity Advisory on Oct. 8, 2026, saying China-based Integrity Technology Group, known as Integrity Tech, enables threat actors to target critical infrastructure sectors worldwide. The advisory attributes the company’s ties to the Chinese government to CISA, the FBI, NSA and their partners. The excerpts available to Breach Signal do not state a confidence level for that attribution.

The Justice Department and FBI timed court-authorized domain seizures with the advisory on the same day. The seized domains supported two Integrity Tech tools, MicroScan and FishHub. Breach Signal’s analysis: the advisory describes how the operation works, and the seizures remove some of the infrastructure it ran on.

What the agencies say Integrity Tech does

The agencies describe Integrity Tech as an enabler. By their account, it acquires or develops cyber tools, hosts infrastructure and compromises networks. In Breach Signal’s analysis, that framing is notable because it names a business that supplies attackers, not only a hacking group.

The [People's Republic of China] relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity

Brett Leatherman, FBI Cyber Division Assistant Director, Nextgov.com

The advisory says the activity overlaps with what researchers publicly track as Flax Typhoon, Ethereal Panda and Red Juliett. The agencies caution that not all of that activity may be linked to Integrity Tech. Readers should treat those group names as overlapping labels, not as proof that every incident under them traces to one company.

The advisory draws on investigations and observed activity in North America, Southeast Asia and Africa. Named victim sectors include government, critical manufacturing, healthcare, law enforcement and education. BleepingComputer also lists IT and religious organizations.

Why the entry points matter to operators

The agencies say the actors target edge devices that organizations monitor little. Edge devices are internet-facing equipment, such as VPN gateways and servers. The goal is long-term, stealthy access.

The actors also use living-off-the-land techniques, which means abusing legitimate administrative tools already on a system. That makes the activity harder to tell from routine administration.

That pattern bears on the split between IT networks and the operational technology that runs plants, hospitals and utilities. The sources describe attacks on the edge of enterprise networks. They do not say any control system was reached, and they do not report service disruptions.

In Breach Signal’s analysis, an unmonitored device at that boundary is still a foothold operators must account for. It sits between the internet and the business systems that often connect to operations.

MicroScan: reconnaissance at scale

MicroScan scans networks for weaknesses. BleepingComputer and Tech Insider describe it as a Python-based scanner with more than 1,300 penetration-testing scripts aimed at software such as Oracle WebLogic, Apache Struts, WordPress and Jenkins. According to the FBI seizure affidavit, it was used with a Mirai-infected botnet, a network of hijacked devices.

Scan targets named in the affidavit included a South Carolina power company, airports in Japan and Poland, Taiwanese gas and power firms and universities. Being scanned does not by itself prove a breach. The FBI did not say whether the named utilities and airports were breached.

The affidavit does describe follow-through in some cases. Two Taiwanese universities scanned with MicroScan in August 2022 and March 2023 were later breached, according to BleepingComputer’s account of the filing.

The advisory lists eight commonly targeted CVEs (Common Vulnerabilities and Exposures IDs), mostly old, including CVE-2019-11510 in Pulse Secure and CVE-2021-22205 in GitLab. Operators should check the vendor advisory or the National Vulnerability Database (NVD) entry for each ID to confirm patch status. The fact sheet does not say whether patches exist for these flaws, so Breach Signal is not asserting that here.

Old flaws still working as entry points is the practical lesson, in Breach Signal’s analysis. A system that was never patched stays exposed no matter how many domains are seized.

FishHub: phishing and file theft

FishHub supported spear-phishing, which is phishing aimed at specific people. It delivered malware that gave remote access and let attackers search for files and exfiltrate them, meaning copy them out of the victim’s network, to servers controlled by Integrity Tech.

Victim counts differ by outlet. Nextgov cites approximately 20 Taiwanese universities as confirmed victims. BleepingComputer says one server held data from more than 20 organizations, including six Taiwanese universities.

The outlets also differ on the number of seized domains. Nextgov reports six and BleepingComputer lists seven. The count does not change what the seizure achieved, but readers comparing coverage will see both figures.

Other tooling appears in the reporting too. Attackers used the open-source EBurst tool for password spraying against Microsoft Exchange servers, which means trying common passwords across many accounts. A custom web app let third parties browse stolen email.

A long record of action against one company

This is not the first government action against Integrity Tech. In September 2024, the Justice Department disrupted its Mirai botnet of more than 200,000 consumer devices. The US sanctioned the company in January 2025, the UK did so in 2025 and the EU followed in 2026.

Each step removed something, yet the October 2026 advisory describes a company still supplying tools and infrastructure. In Breach Signal’s analysis, the advisory may carry the most lasting value for defenders. It gives them indicators of compromise, the technical traces of an intrusion, to search for in their own networks.

What defenders can do

The recommended mitigations are plain. Patch the listed known exploited CVEs, secure edge infrastructure, and disable unneeded exposed services. Enforce multifactor authentication.

The agencies also urge organizations to hunt for compromise using the indicators in the advisory and to report activity to the FBI. For hospitals, manufacturers and small utilities with thin security staff, an inventory of internet-facing devices is a sensible first task, in Breach Signal’s analysis. An unmonitored device cannot be patched or hunted on.

Other recent joint advisories point the same way. Notices on Gunra ransomware and on Iranian-affiliated attacks on water systems also stress patching internet-facing devices. Those cases involve different actors; Breach Signal reads the repeated advice as a sign that the weak points overlap.

What to watch

Seizing domains cuts off infrastructure the tools relied on, but the sources do not say whether Integrity Tech has rebuilt it. Whether the company keeps operating despite US, UK and EU sanctions is a question the reporting leaves open.

Also, unclear is how many scanned organizations were actually breached. The affidavit details two Taiwanese universities, but the FBI did not say whether the named utilities and airports were compromised. Operators who find indicators from the advisory in their logs should report them to the FBI, which would help answer that.