The Cybersecurity and Infrastructure Security Agency (CISA) joined the other intelligence agencies across the globe to issue a joint Cybersecurity Advisory warning about a China-based company enabling threat actors to target critical infrastructure sectors worldwide.
According to the warning, Integrity Technology Group, a company with ties to the Chinese government, is a key enabler of malicious cyber activity. The company, according to multiple sources, has acquired or developed cyber tools, such as large-scale botnets, and hosting infrastructure that allows threat actors to use tactics, techniques and procedures consistent with the activity know publicly as Flax Typhoon, Ethereal Panda and Red Juliett. The agencies said real-world investigations and observed activity in North America, Southeast Asia, and Africa leads officials to believe these threat actors are targeting edge devices that are not closely monitored by the targeted organizations.
“Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing,” Acting Executive Assistant Director for Cybersecurity Chris Butera said. “CISA urges organizations to review this advisory to be aware of the wide range of tactics used by these actors and implement recommended actions and mitigations. The advisory underscores the critical role of collaboration between government agencies and the private sector.”
CISA and the other agencies said organizations can protect their network by patching known exploited common vulnerabilities listed in their report.
Chinese government-linked cyber actors targeted critical infrastructure across several sectors, including government, critical manufacturing, healthcare, U.S. law enforcement and educational organizations.
“Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them,” Assistant Director Brett Leatherman of the FBI’s Cyber Division said. “Integrity Technology Group, a China-based company with ties to the Chinese government, is one of those enterprises, acquiring or developing cyber tools and hosting infrastructure for actors targeting networks worldwide. We urge every organization to apply this advisory’s mitigations and report suspicious activity to their local FBI field office.”
CISA, FBI and other partners urges all organizations, especially those in critical infrastructure to review the advisory, hunt for signs of compromise, and implement the recommended mitigations.