CISA, FBI, NSA and allies warn of China-linked cyber firm aiding global attacks on critical infrastructure

KUALA LUMPUR, 11 OCTOBER 2026 —

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), and international partners have issued a joint cybersecurity advisory warning that Integrity Technology Group (Integrity Tech), a China-based cybersecurity company, is enabling threat actors to target critical infrastructure sectors worldwide—including operational technology (OT) systems—using advanced tools such as large-scale botnets, virtual private network (VPN) infrastructure, and "living off the land" techniques.

The advisory, based on real-world investigations and observed activity in North America, Southeast Asia, and Africa, urges organizations to implement immediate mitigations to detect and respond to these threats.

The warning underscores the growing risk posed by state-linked cyber actors exploiting commercial cybersecurity firms to compromise networks globally. Integrity Tech, which has ties to the Chinese government, is identified as a key enabler of malicious activity by acquiring or developing cyber tools, hosting infrastructure, and facilitating network compromises.

The tactics used by Integrity Tech-enabled threat actors align with publicly known groups such as Flax Typhoon, Ethereal Panda, and Red Juliett, which have been observed targeting edge devices—systems often overlooked by organizations due to their peripheral role in operations.

The advisory follows a pattern of Chinese government-affiliated cyber operations aimed at disrupting critical functions in infrastructure sectors, including government, critical manufacturing, healthcare, law enforcement, and education. According to CISA Acting Executive Assistant Director for Cybersecurity Chris Butera, these actors are positioning themselves within networks to stage future attacks.

"Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing," Butera stated. "CISA urges organizations to review this advisory to be aware of the wide range of tactics used by these actors and implement recommended actions and mitigations."

The FBI’s Cyber Division, led by Assistant Director Brett Leatherman, emphasized that Integrity Tech is not merely a passive enabler but an active participant in hosting infrastructure for cyber threat actors. "Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them," Leatherman said.

"Integrity Technology Group, a China-based company with ties to the Chinese government, is one of those enterprises, acquiring or developing cyber tools and hosting infrastructure for actors targeting networks worldwide. We urge every organization to apply this advisory's mitigations and report suspicious activity to their local FBI field office."

The advisory provides specific technical recommendations, including patching known exploited vulnerabilities (CVEs) and securing edge infrastructure to prevent long-term, undetected access by threat actors. It also directs organizations to hunt for signs of compromise and adopt defensive measures to mitigate risks.

For Malaysian and regional businesses—particularly those in critical infrastructure, manufacturing, healthcare, or government sectors—the advisory serves as a critical alert. While the immediate focus of the warning is on North American and global operations, the tactics described (such as targeting edge devices and leveraging VPN infrastructure) pose risks to organizations across Asia, including Malaysia’s digital and industrial sectors.

The Malaysian Communications and Multimedia Commission (MCMC) and CyberSecurity Malaysia have not yet issued a direct response, but local firms operating in energy, telecommunications, or financial services should review the advisory’s mitigations to assess potential exposure.

The warning follows a broader trend of state-sponsored cyber espionage and infrastructure targeting, with previous reports highlighting Chinese-linked groups exploiting supply chain vulnerabilities and OT systems. The advisory does not specify direct attacks on Malaysian entities but reinforces the need for heightened vigilance in sectors reliant on global supply chains or digital infrastructure.

Organizations are advised to monitor CISA’s China Threat Overview and Advisories for updates and collaborate with local cybersecurity authorities to implement defensive measures.

The joint advisory concludes with a call to action for all organizations, particularly those in critical infrastructure, to review the advisory, conduct threat hunting, and apply recommended mitigations. The U.S. agencies reiterated that reporting suspicious activity to local law enforcement or cybersecurity agencies remains essential to disrupting these threats. The advisory does not provide further details on ongoing investigations but serves as a direct warning to global businesses of the evolving cyber threat landscape.

Related: Integrity Technology Group