Sixteen national cyber agencies co-signed a joint advisory naming Flax Typhoon and Integrity Technology Group as the operators of the China-nexus covert network Raptor Train, at over 200,000 infected SOHO routers; the separate KV Botnet is used by Volt Typhoon for US critical national infrastructure pre-positioning1. Integrity Technology Group was sanctioned by OFAC in January 2025 and by the UK in December 2025; the joint advisory delivers the first co-signed public attribution of its operational role. Signatories include NCSC, CISA, the NSA, FBI, German BSI, Dutch AIVD, Japan's NCO, Australia's ASD and Canada's CSE among others, the broadest public attribution gesture of the year to date.
The document tells operators in printed form what the Salt Typhoon caseload and the Volt Typhoon CNI assessments had implied since BRICKSTORM: indicators of compromise (the IP addresses, file hashes and signatures defenders feed into blocklists) now disappear as fast as analysts can publish them. The advisory's exact wording, anchored by NCSC, treats indicator-based filtering as a secondary control rather than a primary one. Targets named in the document span energy, healthcare, transport, digital infrastructure and government across the participating jurisdictions.
NCSC and CISA are asking security operations Teams to retire the dynamic threat-feed filtering metric and replace it with a dwell-time metric: how long an attacker stays undetected inside the network. That reframes the whole detection-engineering investment cycle. Behind it sits the same NCSC attribution muscle that produced the APT28 advisory in March; ahead of it sits a pressure track on SOC tooling vendors to surface dwell metrics by default and a sanctions surface that previously sat behind classified boundaries.
