Integrity Tech: UK’s NCSC and allies call out a Chinese company that helped hackers steal sensitive data

A China-based company with ties to the Chinese government has been called out by ten cyber security, law enforcement and intelligence agencies from seven countries. On Thursday, October 8, the UK’s National Cyber Security Centre (NCSC), part of GCHQ, announced that Integrity Technology Group (Integrity Tech) provided malicious Chinese actors with the means to breach the networks of organisations around the world and steal confidential data, including from critical infrastructure sectors.

In addition to the NCSC, the joint advisory (reference AA26-281A) is signed by the US FBI, CISA and NSA, the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security, Japan’s National Police Agency and National Cybersecurity Office, New Zealand’s NCSC and Spain’s National Intelligence Centre (CNI). The technical details come from FBI investigations. The techniques match activity publicly known as Flax Typhoon, Ethereal Panda and Red Juliett, among others, while the same actors may also carry out activity not linked to the company.

NCSC Director of Operations Paul Chichester said the activities and services of Integrity Tech that were exposed “should be of particular concern to all network defenders”. “We will continue to call out malicious actors and the malign ecosystem they operate in,” he added.

A known company

The company is not new to the agencies. In September 2024 the NCSC and its partners exposed it as the operator of a large botnet, a network of infected devices controlled remotely, which the Flax Typhoon group used. On December 9, 2025 the British government imposed sanctions on it for operating a covert cyber network and providing technical assistance to others for attacks.

Targets were organisations in four US critical infrastructure sectors (government services, critical manufacturing, health and information technology), law enforcement agencies, educational and religious institutions in the US, and organisations in Southeast Asia, Africa and North America.

How the actors work

The advisory describes the method. The actors begin with scanning, using open-source tools such as masscan, NMAP and wpscan, as well as the Python application MicroScan, with more than 1,300 penetration-testing scripts for services such as WordPress, Jenkins and Apache Struts, in use since at least 2017. The NCSC stresses the combination of AI tools, such as automated scanning, with large-scale botnets and manual exploitation.

For initial access they have used, since at least mid-January 2021, mainly command-line tools based on exploit code in languages such as Python and Go, and also cross-site scripting (XSS) attacks, injecting malicious code into a vulnerable web page. The FBI recovered one such payload, which shows fake username and password fields and offers a zip file with the executable live700_v1.exe. It starts a process named DiagTrack.exe, the same as legitimate Windows software, and communicates with the domain dns.studiocloud.xyz, which the FBI attributes to Integrity Tech. The EBurst tool tries passwords against Microsoft Exchange and Office 365 accounts, while SoftEther VPN software, under names such as conhost.exe, keeps access open.

Emails are then drained with a PHP script and the office-cli tool, and DC.exe copies credentials from Active Directory using the DCSync technique. In some cases access to the stolen data was restricted to IP addresses from Xiamen, China. The advisory records eight vulnerabilities from 2014 to 2023 that were successfully exploited, in products such as Bash, GitLab, Apache Struts and Pulse Connect Secure. Five of them have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

The agencies recommend disabling unused services and ports, sanitising user input in web applications, and requiring multi-factor authentication (MFA), especially for webmail, VPNs and critical systems. They also call for timely software updates, as the recent critical PHP vulnerabilities showed, network segmentation and monitoring for unusual Active Directory replication.