Canada co-signs advisory on Chinese firm Integrity Tech enabling state hackers
The Canadian Centre for Cyber Security joined the FBI, CISA, the NSA and agencies from the U.K., Australia, Japan, New Zealand and Spain on Oct. 8 in publishing a joint advisory on Integrity Technology Group, a China-based company that the authors say enables Chinese government-linked hackers to break into networks worldwide.
The advisory is unusual because it focuses on a for-profit company rather than a single hacking team. The agencies say Integrity Tech employees build and sell hacking tools, run infrastructure and compromise victims, feeding a wider Chinese ecosystem aimed at stealing data.
What the advisory says
According to advisory AA26-281A, the actors combine automated scanning tools, large botnets, VPN infrastructure and hands-on techniques. They scan with open-source tools such as masscan, Nmap and Fscan, and since as early as 2017 have used an application called MicroScan, which contains more than 1,300 scripts for finding flaws in products such as Oracle WebLogic, Jenkins, Apache Struts and WordPress.
For initial access, the actors use custom exploit scripts, cross-site scripting attacks that display fake login fields to harvest credentials, and a Python tool called EBurst for password spraying against Microsoft Exchange and Microsoft 365 accounts. They maintain persistence through VPN software and use scripts to exfiltrate email and credentials. The advisory lists older vulnerabilities seen in recovered scripts, including CVE-2019-11510 in Pulse Secure VPN and CVE-2021-22205 in GitLab.
The agencies say activity tied to Integrity Tech overlaps with groups known as Flax Typhoon, Ethereal Panda and Red Juliett. Victims include U.S. government, manufacturing, health-care and IT organizations, as well as law enforcement, education and religious groups and organizations across Southeast Asia, Africa and North America. The findings come from evidence recovered in several FBI investigations.
Context
Integrity Tech has been named before. Allied agencies tied it to a Flax Typhoon botnet in September 2024, and in April 2026 the Cyber Centre co-signed U.K.-led guidance warning that Chinese information security companies build covert networks of hacked routers for state hackers. The U.K. sanctioned the company in December 2025.
The advisory is also posted by the FBI's Internet Crime Complaint Center with indicators of compromise in STIX format.
What to do
- Disable unused services and ports, including remote access and file-sharing protocols.
- Require multi-factor authentication on Exchange, Microsoft 365 and VPN accounts, and watch for password-spraying patterns.
- Sanitize input in web applications to block cross-site scripting.
- Patch long-known flaws in VPNs and web applications, and hunt using the advisory's indicators.
Key points
- The Cyber Centre co-signed advisory AA26-281A on Integrity Technology Group, published Oct. 8, 2026.
- Agencies say the China-based company supplies tools and infrastructure to state-linked hackers.
- Actors use MicroScan, XSS credential harvesting and EBurst password spraying on Exchange.
- Activity overlaps with Flax Typhoon; victims include organizations in North America.
