Integrity Technology Group
Beijing cybersecurity firm sanctioned by the US, UK and EU for enabling Flax Typhoon.
Integrity Technology Group was named on 8 October 2026 in advisory AA26-281A, in which ten Western and Asian agencies called the Beijing firm a for-profit builder and seller of hacking tools serving Chinese state-linked intruders.
Last refreshed: 12 October 2026 · Appears in 1 active topic
What does a sanctioned Beijing security firm sell to Chinese state hackers?
Timeline for Integrity Technology Group
Ten agencies name Beijing firm in hacks
Cybersecurity: Threats and DefencesUAT-8616 keeps Cisco SD-WAN under fire
Cybersecurity: Threats and DefencesOperated Raptor Train 200,000-device botnet and KV Botnet used by Volt Typhoon
Cybersecurity: Threats and Defences: Sixteen cyber agencies name Flax Typhoon networkBackground
Integrity Technology Group, also known as Integrity Tech, is a cybersecurity company in Beijing. Western governments now treat it as a private contractor inside China's state hacking effort: the October 2026 advisory, co-signed by the FBI, NSA, CISA and the UK NCSC among others, said hackers it equips use methods consistent with Flax Typhoon. Its listed victims include US government bodies and healthcare and IT organisations.
The FBI and allied agencies first exposed the company in September 2024. They said it controlled a botnet of more than 260,000 compromised devices used by Flax Typhoon, the network now known as Raptor Train. The US Treasury sanctioned it on 3 January 2025, Britain followed on 9 December 2025 over its control of a covert cyber network, and the EU added sanctions in March 2026. Researchers have since assessed, without formal attribution, an infrastructure overlap between its networks and UAT-8616, a group exploiting a top-severity Cisco flaw in May 2026.
Integrity Tech matters as a test case. Its designation shows allied governments mapping Chinese state hacking as a supply chain of commercial vendors, with sanctions and advisories aimed at the firms as well as the state units they serve.
Integrity Tech is cast as hacking contractor
Integrity Tech's exposure sharpened through 2026. In the sixteen-nation guidance of 23 April it appeared as co-operator, with Flax Typhoon, of a botnet of more than 200,000 hijacked home routers.
AA26-281A, released on 8 October, went further. It portrays The Firm as a business with Chinese government links that develops or buys intrusion tools to use and to sell, hosts attack infrastructure and breaks into networks itself. The tools listed include the MicroScan scanner, an email-theft utility called office-cli and SoftEther VPN. Japanese police dated the activity to January 2016, and CISA gave federal bodies until 11 October to fix five old flaws used in the campaign.
Why was Integrity Technology Group sanctioned by the US?
What did Integrity Technology Group actually do for Chinese intelligence?
Is Integrity Technology Group a government company or private?
Is UAT-8616 linked to Integrity Technology Group?
What is advisory AA26-281A about?
