CISA, FBI, NSA Flag China's Integrity Tech Cyber Threat

U.S. and allied agencies have named China’s Integrity Tech as an enabler of global cyberattacks

The attacks were found to have struck government, manufacturing, healthcare, law enforcement and education targets

Joint advisory urges patching of exploited common vulnerabilities and exposures, with tighter oversight of edge devices

The Cybersecurity and Infrastructure Security Agency, the FBI, the National Security Agency and foreign partners have released a joint cybersecurity advisory identifying Integrity Technology Group, a Chinese cybersecurity firm, as a facilitator of hacking campaigns against critical infrastructure organizations worldwide .

CISA said Thursday the guidance draws on investigations and activity seen in Africa, North America and Southeast Asia.

CISA’s Acting Associate Director for Threat Hunting Bobby Thompson will be among the keynote speakers at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10, wherein Department of Homeland Security leaders and industry together will the strategic DHS priorities. Register today to hear from government decision-makers through keynotes, panels and Q&A sessions.

What Does the Integrity Tech Advisory Reveal?

According to the advisory, Integrity Tech, which the agencies tie to the Chinese government, procures and builds cyber tools, hosts infrastructure and breaches networks globally. Actors it supports rely on living-off-the-land techniques, large botnets and virtual private network infrastructure. Their methods mirror tradecraft publicly tracked as Red Juliett, Flax Typhoon and Ethereal Panda.

Which Sectors Have the Actors Targeted?

The advisory says the actors struck government, critical manufacturing and healthcare entities, along with U.S. law enforcement agencies and education institutions. To keep stealthy, persistent footholds, they have focused on edge devices that victims seldom monitor closely.

What Mitigations Do CISA, FBI and NSA Recommend?

The agencies are urging all organizations, particularly critical infrastructure operators, to review the guidance, hunt for indicators of compromise and apply its mitigations. Those include hardening edge infrastructure and patching common vulnerabilities and exposures, or CVEs, that adversaries have already exploited.

How Are Officials Characterizing the Threat?

Chris Butera , CISA’s acting executive assistant director for cybersecurity, said actors affiliated with Beijing are embedding themselves in critical infrastructure, including operational technology systems, “with the aim of disrupting critical functions at a future time of their choosing.”

Brett Leatherman , assistant director of the FBI Cyber Division, said the bureau’s cyber strategy targets both threat actors and “the enterprises that support them.” He called on organizations to flag suspicious activity to their nearest FBI field office.

What Other China-Linked Threats Have U.S. Agencies Flagged?

In August, NSA, the FBI and the Cyber National Mission Force warned of QTFY , a China-linked hacking group, as the Justice Department seized domains tied to its tools. In April, CISA and the U.K.’s National Cyber Security Centre detailed how Volt Typhoon and Flax Typhoon build covert networks from compromised routers and internet-of-things devices. In September, the three agencies highlighted Chinese AI firms’ distillation campaigns against U.S. frontier models.

The warning follows the White House’s March release of its Cyber Strategy for America and the Department of War’s 2026 National Defense Strategy , which prioritizes homeland cyber defense.