The National Cyber Security Centre and partners from six countries published a joint advisory on Thursday detailing how Integrity Technology Group, a China-linked firm sanctioned by the UK last year, supplies infrastructure and tooling used in global intrusion campaigns.

The bulletin ties Integrity Tech to activity consistent with groups tracked as Flax Typhoon, Ethereal Panda and Red Juliett, blending automated AI-assisted scanning with large botnets and manual exploitation on victim networks.

Techniques in the advisory

According to the NCSC, actors enabled by Integrity Tech combine AI tools for reconnaissance with botnet scale and operator-led persistence once initial access succeeds. Targets span critical manufacturing, telecommunications and government-adjacent suppliers, with confidential data theft rather than destructive wipers as the primary objective.

UK government ministers previously sanctioned Integrity Tech alongside another Chinese information-security company for malicious activity against Britain and allies. Thursday’s release is a naming-and-shaming exercise aimed at network defenders reviewing third-party remote-access tools and edge appliances.

What defenders should do

The NCSC urges organisations to adopt its disruptive-attack collection guidance: patch internet-facing services, enforce phishing-resistant multifactor authentication, and segment flat networks that let intruders pivot from IT to operational technology.

The advisory stresses that AI-enabled scanning lowers the cost of finding forgotten VPN portals.

Managed service providers serving UK mid-market firms should verify whether any monitoring or “threat intelligence” products in their stack originate from Integrity-linked vendors. Supply-chain due diligence now includes reviewing parent-company ownership in Beijing as well as software bill-of-materials checks.

UK policy context

The release lands days after separate NCSC warnings about critical PHP vulnerabilities affecting public-sector websites. Together, the notices sketch a threat picture mixing commodity web bugs and state-aligned ecosystems selling full-service access.

Paul Chichester, NCSC director of operations, said the breadth of sectors targeted “should be extremely concerning for all network defenders.” For CISOs reporting to UK boards, the practical takeaway is to treat integrity of remote-management tools as a board-level resilience metric, not an IT hygiene checkbox.

Sector-specific guidance

Telecommunications firms named in the advisory should review edge routers and law-enforcement assistance interfaces, common pivot points in Flax Typhoon reporting. Manufacturers are urged to disable unused remote desktop services exposed during pandemic remote-work rollouts.

The UK’s Cyber Essentials Plus scheme does not yet test for AI-driven reconnaissance, but certification bodies are updating questionnaires to ask whether organisations monitor outbound DNS queries typical of botnet enrolment.

Integrity Tech’s prior sanctioning means UK companies face criminal penalties for paying the firm for “penetration testing” services that mirror offensive kits. Legal teams should scrub procurement databases for Chinese security vendors added during cost-cutting exercises.

Incident responders note that blended AI and manual campaigns produce noisy logs that overwhelm small SOC teams; managed detection providers are marketing playbooks specifically for the TTPs listed in Thursday’s joint bulletin.

International coordination

Partners signing Thursday’s advisory included agencies from the United States, Canada, Australia and European members of the Five Eyes community, reflecting shared intelligence on Integrity Tech infrastructure hosted in Chinese cloud regions. Sanctions alignment means UK firms cannot substitute US-branded security tools if parent companies maintain Integrity contracts.

Critical national infrastructure operators must report incidents to the NCSC within 72 hours under updated rules; the Integrity bulletin gives incident handlers specific indicators of compromise to hunt for on edge firewalls and VPN concentrators.

Insurance underwriters are revising cyber policies to exclude state-sponsored events unless buyers purchase war-risk riders, a change that affects mid-market manufacturers relying on Integrity-linked monitoring services unknowingly.

NCSC helplines reported higher call volumes from school academy trusts asking whether student information systems bundled with Chinese-made hardware require replacement, a compliance scramble that may take quarters rather than weeks.

Cloud email gateways should block newly registered domains mimicking Integrity Tech subsidiaries, a low-cost control NCSC lists in annexes to the joint advisory.