Last week, the DHS Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), and international partners issued a joint Cybersecurity Advisory warning[1] that Integrity Technology Group (Integrity Tech), a China-based cybersecurity company, is enabling threat actors to target multiple critical infrastructure sectors worldwide using a range of sophisticated tools, such as large-scale botnets, virtual private network infrastructure and living off the land.
With ties to the Chinese government, Integrity Tech is a key enabler of malicious cyber activity by acquiring or developing cyber tools, hosting infrastructure, and compromising networks globally. These Integrity Tech-enabled threat actors are using tactics, techniques, and procedures (TTPs) consistent with activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett. To maintain long-term, stealthy access to networks, these actors are targeting edge devices that are not closely monitored by the targeted organization.
The advisory includes a range of actionable steps for network defenders to secure edge infrastructure and protect their networks which includes patching the listed known exploited common vulnerabilities and exposures (CVEs). Critical infrastructure across sectors being targeted include government, critical manufacturing, and healthcare. They also targeted victims in US law enforcement, religious and education organizations.
Based on real-world investigations and observed activity in North America, Southeast Asia and Africa, this advisory provides recommended mitigations and information to help network defenders detect and respond to this malicious activity. CISA urges organizations to review this advisory to be aware of the wide range of tactics used by these actors and implement recommended actions and mitigations. The advisory underscores the critical role of collaboration between government agencies and the private sector.
For more information, please visit China Threat Overview and Advisories: https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors/china
This article used AI to craft the contents and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
Comments