US agencies warn Integrity Technology Group enables China‑linked critical‑infra attacks

On October 8, 2026, CISA, the FBI, the NSA and international partners warned that Integrity Technology Group, a China‑based company linked to the Chinese government, enables threat actors to target critical infrastructure sectors worldwide.

The advisory recommends that organizations disable unused services and ports. It also advises patching known exploited vulnerabilities. Organizations should use multifactor authentication for webmail, VPNs and critical system access. Finally, the advisory urges monitoring for living‑off‑the‑land tools (tools that use legitimate system functions for malicious purposes) and abnormal network traffic.

The advisory notes that the threat actors involved use tactics associated with the threat clusters Flax Typhoon, Ethereal Panda and Red Juliett.

The advisory identifies Integrity Technology Group as providing tools such as MicroScan and FishHub. Attackers have used these tools in intrusions against U.S. and foreign critical infrastructure. According to the advisory, attackers have used the MicroScan vulnerability‑scanning platform since at least 2017 to identify security weaknesses in targets.

The advisory states that the threat actors linked to Integrity Technology Group target sectors including government, critical manufacturing, healthcare, law enforcement, education, information technology and religious organizations. It also notes that attackers have affected entities in Southeast Asia, Africa and North America.

The advisory identifies eight specific CVEs commonly exploited by the actors, including CVE‑2015‑3306, CVE‑2015‑5477, CVE‑2016‑3081 and CVE‑2021‑3199. It also lists CVE‑2023‑22894, CVE‑2014‑6278, CVE‑2019‑11510 and CVE‑2021‑22205 as examples.

The advisory states that the attackers use the open‑source EBurst tool for password‑spraying attacks against Microsoft Exchange and Office 365 accounts. The advisory reports that the actors install legitimate SoftEther VPN software on victim devices, often renaming the installer to mimic Windows files, to maintain hidden command‑and‑control channels. The advisory describes a script that pulls email via Microsoft’s Exchange Web Services, uploads it to a remote server, obscures files and compresses (sometimes encrypts) the data for exfiltration.

The advisory urges organizations to follow Cross‑Sector Cybersecurity Performance Goals from CISA and NIST. These goals include disabling unused services and configuring login pages to reveal minimal information. They also recommend sanitizing user input to block XSS and using MFA where possible.

The advisory recommends monitoring for unauthorized use of living‑off‑the‑land tools. It also advises watching for unexpected Active Directory replication and network segmentation. Finally, the advisory suggests watching for abnormal outbound uploads and suspicious command‑line artifacts.