UK-Led Advisory Ties China-Linked Botnet Operator Integrity Tech to Data-Theft Campaigns

The UK National Cyber Security Centre (NCSC), part of GCHQ, said in a joint advisory published Oct. 8, 2026, that malicious cyber activity enabled by China-based company Integrity Technology Group threatens sensitive data held by organizations worldwide. The advisory was co-signed by eight partner agencies from six countries: Australia, Canada, Japan, New Zealand, Spain and the United States, alongside the NCSC, according to the NCSC.

According to the advisory, the agencies assess that actors enabled by Integrity Tech use AI-assisted tools, including automated scanning, together with large-scale botnets, networks of compromised devices remotely controlled by an attacker, and hands-on-keyboard exploitation to compromise networks and steal data. The agencies describe this activity as consistent with campaigns publicly tracked under three different names: Flax Typhoon, Ethereal Panda and Red Juliett, the NCSC and Security Affairs reported. Tracking the same group under multiple vendor names is common in this space, and the overlap points to a single commercial operation supporting several labeled campaigns rather than three separate actors.

The extensive malicious cyber activities, and services by Integrity Tech, that have been exposed today should be extremely concerning for all network defenders.

Paul Chichester, National Cyber Security Centre

A company with a history on the sanctions list

This is not the first time Integrity Tech has drawn attention from Western agencies. In September 2024, the NCSC and international partners identified Integrity Tech as the operator of a large botnet used by the Flax Typhoon group, according to the NCSC and Security Affairs. The UK government sanctioned Integrity Tech on Dec. 9, 2025, alongside another China-based firm, Sichuan Anxun Information Technology (i-Soon), for what it called reckless malicious cyber activity against the UK and its allies, the NCSC and the UK government said. i-Soon was separately cited for targeting more than 80 government and private-industry IT systems worldwide, the UK government said.

The pattern extends beyond Integrity Tech. In August 2025, the UK and 12 other countries co-signed an advisory linking three separate China-based companies to the SALT TYPHOON espionage campaign, which has targeted governments, telecommunications, transportation and military infrastructure globally, the UK government said. Taken together, these advisories describe a recurring structure: Chinese commercial entities providing infrastructure and tooling that state-linked groups use for intrusion and data theft, with Western agencies naming the companies as a deterrence measure.

A separate advisory: botnets built from routers, cameras and NAS boxes

Distinct from the Integrity Tech advisory, a related but separate joint advisory, titled ‘Defending Against China-Nexus Covert Networks of Compromised Devices,’ was published around April 23, 2026, by the NCSC with the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the NSA and agencies from Australia, Canada, Germany, Japan, the Netherlands, New Zealand, Spain and Sweden, according to Industrial Cyber and Executive Gov. That advisory describes China-nexus actors shifting away from individually procured attack infrastructure toward large-scale botnets built from compromised small office and home routers, internet-of-things devices, cameras and network-attached storage (NAS) systems, devices that store files and make them accessible over a network, Security Affairs and Industrial Cyber reported. These covert networks are used across the full intrusion lifecycle, from reconnaissance through malware delivery, command and control, and data exfiltration, the agencies said.

One example cited in the April advisory is the Raptor Train botnet, which at its peak compromised more than 200,000 devices, including routers, network video recorders, NAS servers and IP cameras, since May 2020, and which was controlled by Integrity Tech and linked to Flax Typhoon, according to Security Affairs and Industrial Cyber. A separate China-linked actor, Volt Typhoon, built its KV Botnet from vulnerable, end-of-life Cisco and NetGear routers no longer receiving security updates, Industrial Cyber reported. CISA Acting Director Nick Andersen said the advisory informs organizations how Chinese state-sponsored actors deploy covert networks at scale, according to Industrial Cyber and Executive Gov.

Covert networks enable China-nexus actors to launch cyber attacks against UK organisations, stealing sensitive data and potentially disrupting critical services.

NCSC advisory, Security Affairs

Why static defenses are falling behind

The April advisory highlights a problem the agencies call ‘IOC extinction,’ where IOC refers to an indicator of compromise, a technical artifact such as a known-bad IP address used to detect malicious activity: because covert network nodes are shared across several threat actor groups and constantly refreshed, lists of such indicators become outdated almost as soon as they are published, according to Security Affairs, Industrial Cyber and TheDefenseWatch.com. That undercuts a defense model many enterprises still rely on, where security teams block traffic based on static block lists updated periodically. When the infrastructure churns this fast, a block list from last month offers little protection against this month’s traffic.

The agencies instead recommend baseline defenses including mapping network edge assets, establishing normal traffic patterns for VPN and remote-access connections, subscribing to dynamic threat intelligence feeds that update continuously, and deploying multifactor authentication on all remote connections, according to Security Affairs, Industrial Cyber and Executive Gov. For larger or higher-risk organizations, the advisory recommends IP allow lists, zero trust network controls, geographic and behavioral traffic filtering, machine certificate verification and machine-learning-based anomaly detection. The largest organizations are urged to actively hunt for covert network traffic using NetFlow analysis rather than waiting for alerts, Security Affairs and Industrial Cyber reported.

NCSC leadership has indicated its teams respond to about four incidents a week that rise to national significance, a share of them tied to state-backed actors operating out of China, Russia and Iran, according to TheDefenseWatch.com. The covert-networks advisory was also presented at the CYBERUK 2026 conference in Glasgow, the outlet reported. For US enterprises, the practical takeaway is that any internet-facing router, camera or NAS device on a corporate or remote-employee network is a potential botnet node, and defenders should treat traffic anomalies from residential IP ranges as a signal worth investigating rather than dismissing as noise.