Review ITG-Linked Threat Indicators After US Agencies Warn of Infrastructure Attacks

The US Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the National Security Agency issued a joint warning regarding Chinese government-linked threat actors. These groups are using automated scanning and botnets to infiltrate networks and steal sensitive data from organizations worldwide, according to Industrial Cyber.

The agencies identified Integrity Technology Group as a key enabler for these hackers. This China-based, for-profit company has links to the Chinese government and helps attackers exploit networks across multiple sectors. The joint advisory details how these actors combine compromised infrastructure with legitimate software to maintain access and exfiltrate email data and credentials from victim organizations.

Tactics and Techniques

The 58-page advisory outlines specific methods used by these threat actors to breach defenses. They employ automated reconnaissance and vulnerability scanning to find entry points on internet-facing systems. According to the report, the hackers also use virtual private network software to establish persistence within compromised environments, allowing them to remain undetected for extended periods while stealing information.

The agencies linked these operations to activity publicly tracked as Flax Typhoon, Ethereal Panda, and Red Juliett. These groups exploit known vulnerabilities and conduct cross-site scripting attacks to gain initial access. They also use password spraying techniques to compromise account credentials, demonstrating a diverse toolkit for bypassing security controls and moving laterally within targeted networks.

Sector Impact and Risk

Integrity Technology Group is targeting organizations across multiple sectors, including US critical infrastructure. The advisory highlights the risk to operational technology systems, which are essential for maintaining critical functions. Chris Butera, acting executive assistant director for cybersecurity at CISA, stated that these actors position themselves within these networks with the aim of disrupting functions at a future time of their choosing.

This strategic positioning suggests a long-term campaign rather than immediate disruption. The actors are building access reserves within critical infrastructure networks to potentially cause significant damage later. The guidance is intended to help organizations identify malicious activity and mitigate exposure to these China-linked cyber operations before they can execute their disruptive objectives.

What to watch

Organizations should review the advisory’s indicators of compromise and documented tactics, techniques, and procedures. The agencies urge businesses to hunt for evidence of unauthorized access within their own networks. Strengthening defenses around internet-facing services, account credentials, and remote access is critical to protecting sensitive information from these sophisticated threat actors.

Background: Password spraying

Password spraying and brute force differ in direction and speed. Brute force attacks one account with many passwords until it works. Password spraying attacks many accounts with one common password. This distinction determines how your detection systems trigger and what controls stop the attack effectively.

Read the full guide: Password Spraying vs Brute Force: The Critical Difference Explained

What to do and how to stay safe: Integrity Technology Group

• Review the joint advisory for specific indicators of compromise and check your logs for matches.
• Audit all internet-facing services to ensure they are patched and configured securely.
• Enforce strong password policies and monitor for signs of password spraying attacks.
• Verify the security of remote access tools and VPN configurations for unauthorized changes.

Step-by-step guide: Implement Vulnerability Scanning: A Step-by-Step Operational Guide

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which companies are involved in this warning?

CISA, the FBI, and the NSA issued the joint advisory regarding the threat.

What is Integrity Technology Group?

It is a China-based, for-profit company with links to the Chinese government that enables hackers.

What sectors are being targeted?

The actors are targeting organizations across multiple sectors, including US critical infrastructure.