The FBI, CISA, and international partners said in an Oct. 8 advisory that actors linked to Integrity Technology Group have been blending automated scans, botnet traffic, and hands-on keyboard work against U.S. manufacturing networks, often entering through VPN appliances and staying inside long enough to pull email and credentials. Sam Rivera reports the alert is aimed at plant IT teams and their vendors, not consumers, but any employee who VPNs into a factory from home is part of the blast radius if multifactor authentication is optional.
What investigators say they saw
The advisory, cataloged as AA26-281A, describes Chinese government-linked groups using Integrity Tech infrastructure to stage attacks across North America, Southeast Asia, and Africa. Techniques include cross-site scripting against internet-facing apps, password spraying on Microsoft Exchange, and persistence through commercial VPN software that blends with legitimate remote-work traffic.
Targeted sectors named in the release include critical manufacturing, healthcare, government services, and education. U.S. law-enforcement agencies also appear in the victim list, which is why the FBI co-signed the notice rather than leaving it to network vendors.
Why manufacturing VPNs are the weak hinge
Plants adopted always-on VPNs during supply-chain disruptions, and many never rolled them back. When a VPN concentrator misses a patch, attackers do not need to breach the corporate headquarters; they can land on the same network segment that talks to historians, barcode systems, and maintenance laptops.
Integrity Tech’s role, according to the government write-up, is enabling large-scale botnets and VPN infrastructure that other clusters—publicly tracked under names such as Flax Typhoon—use for command and control. The advisory does not allege every scan succeeds, but it warns that successful footholds led to email collection and scripted credential theft.
Actions CISA wants this week
Federal guidance in the alert reads like a short punch list for overworked IT shops: turn off unused ports and legacy protocols, validate and patch internet-facing Exchange builds, and enforce MFA on VPN and webmail even when plant managers resist the extra login step. Input sanitization on custom web portals matters because some incidents started with injection bugs on supplier-facing sites rather than phishing.
State and local manufacturers without a dedicated SOC should ask their managed service provider whether outbound traffic to known Integrity Tech infrastructure has been blocked at the firewall. CISA also encourages hunting for anomalous VPN sessions that stay connected through weekends when production lines are idle.
What plant employees should not do
Do not install unauthorized remote-desktop tools on control-room PCs to “make IT’s job easier.” The advisory highlights living-off-the-land techniques that hide inside approved software. Report duplicate MFA prompts and unexpected VPN disconnects; those can be signs someone else is trying to enroll a device.
If your employer issues a breach notice tied to this campaign, rotate passwords only after IT confirms the VPN gateway is patched. Changing passwords on a still-compromised concentrator just gives attackers fresh credentials to harvest.
Insurance and disclosure tail
Manufacturers with cyber policies should check whether timely patching of edge VPNs is a warranty condition. Several insurers have tightened language around known exploited vulnerabilities, separate from this specific advisory. Document patch dates and MFA enrollment rates now; adjusters will ask for them if ransomware follows a foothold.
Smaller suppliers on the hook
Tier-two vendors that email CAD files or maintenance schedules into plant inboxes are part of the attack surface even if they never visit the factory floor. The advisory’s education-sector victims remind IT shops that a compromised university VPN account can be pivoted into a defense subcontractor if federated logins are trusted too broadly. Review cross-tenant trust the same week you patch the concentrator.