UK and Allies Call Out China-Linked Firm Enabling Global Cyber Attacks

The National Cyber Security Centre, part of GCHQ, published a joint advisory on 8 October 2026 with agencies from Australia, Canada, Japan, New Zealand, Spain and the United States, exposing Integrity Technology Group — Integrity Tech — which the advisory describes as a China–based company with links to the Chinese government. According to the advisory, malicious cyber actors enabled by the company are using AI tools such as automated scanning, large–scale botnets and hands–on exploitation to compromise networks and steal confidential data from organisations across the globe, including in critical sectors. The activity is reported to be consistent with campaigns publicly known as Flax Typhoon, Ethereal Panda and Red Juliett. The advisory is co–sealed by eight partner agencies across six countries and also published through the FBI’s Internet Crime Complaint Center.

For most UK businesses, the instinct with a state–linked advisory is to file it under “not aimed at us”. NCSC Director of Operations Paul Chichester was explicit that this would be the wrong reading: “all organisations should take note of this warning and engage with NCSC advice and guidance.” There is a concrete reason that applies to small organisations in particular. This is not the first time Integrity Tech has been named. In September 2024, the NCSC and partners exposed it as the operator of a substantial botnet of compromised internet–connected devices used by Flax Typhoon. Botnets of that kind are not built from government servers. They are built from routers, cameras, storage boxes and appliances sitting on ordinary business and home connections. A small business is unlikely to be the target of a campaign like this. It is entirely plausible for one to be part of the infrastructure it runs on.

What the advisory says

The advisory’s central claim is that Integrity Tech enables malicious cyber activity rather than simply being one actor among many. It reportedly employs individuals who support a range of activities and contribute to what the advisory calls the wider Chinese cyber ecosystem: developing tools for use and sale, acquiring and hosting infrastructure, and directly compromising networks worldwide. That description matters because it explains the scale. A company that builds tooling, supplies infrastructure and conducts operations sits upstream of many campaigns at once, which is consistent with the activity being mapped onto three separately named threat clusters.

The methods are a combination that small organisations should read carefully. AI tools such as automated scanning find exposed systems at a speed and breadth no human team can match. Large–scale botnets provide both the reach to scan and a layer of compromised devices through which to route activity. Hands–on exploitation follows where something valuable is found. The first two are indiscriminate by design: they touch everything reachable from the internet, regardless of who owns it. Only the third is targeted.

The breadth is the point of Chichester’s warning. “The extensive malicious cyber activities, and services by Integrity Tech, that have been exposed today should be extremely concerning for all network defenders,” he said. “The breadth of sectors that have been targeted across the globe demonstrate the extent of the threat and all organisations should take note of this warning and engage with NCSC advice and guidance.” Coming from the NCSC’s operational lead, “all organisations” is a deliberate choice of words rather than a formula.

Attribution should be stated precisely. The advisory is the joint position of the NCSC and eight partner agencies; it is a government attribution, made publicly and co–sealed internationally, and it describes Integrity Tech as having links to the Chinese government. That is significant weight. It remains the advisory’s account, and we report it as such rather than adding claims of our own about the company or its relationships.

Two exposures, two years apart

The chronology below follows the public record. The repetition is the important part: the same company, named twice, with the second advisory broader than the first.

The two–year gap between the advisories is worth noticing for what it says about persistence. Public exposure in 2024 did not end the activity; the 2026 advisory describes a broader set of capabilities, now including automated scanning. That is the normal pattern with well–resourced actors, and it is why defences that depend on a particular campaign being disrupted are weaker than defences that reduce what is exposed in the first place.

Which devices get conscripted

The chart below is an indicative planning model — not measured data — ranking common internet–exposed devices in a UK SME by how likely they are to be compromised and absorbed into a botnet or covert network if left in their typical state.

The pattern in that ordering is that the riskiest devices are the ones nobody thinks of as computers. Laptops get patched because someone manages them. Routers, cameras and storage boxes tend to be installed once, often by a supplier, and then left untouched for years — frequently after the manufacturer has stopped issuing updates. They run on the open internet, they rarely log anything a business reviews, and their compromise does not interrupt anything the owner would notice. They are close to the ideal building block for a botnet, which is exactly what they have been used for.

The fourth row is a reminder that “security device” does not mean “secure”. VPN and firewall appliances sit at the edge by design and have been a consistent target in recent advisories, including the actively exploited Citrix NetScaler flaws covered here last week. A boundary device that is not patched promptly is not protecting the boundary; it is the most attractive point on it.

All three techniques start from the same place

Set the advisory’s three named methods side by side and ask where each one begins.

Automated scanning, by definition, can only find what answers. A botnet of compromised internet–connected devices can only recruit devices that are internet–connected and compromisable. Hands–on exploitation typically follows from what scanning has found. None of these begins with a targeted email to a particular person; all of them begin with a service, port or device visible from the outside. That is the most useful thing a small business can take from an advisory about a sophisticated, state–linked ecosystem: its methods converge on a surface the business controls.

The AI element changes the timing rather than the principle. When discovery was manual, an exposed device on an obscure connection might go unnoticed for a long time. Automated scanning makes obscurity worth very little, because the cost of checking everything is close to zero and the scan does not tire. The defensive implication is that “nobody would bother with us” was always a weak assumption and is now close to an irrelevant one. Nobody has to bother. The scanning does it for them.

It follows that the controls which matter most are not exotic. Knowing what you expose, removing what you do not need to expose, patching or replacing what remains, and changing default credentials on anything that has them. These are the foundations of Cyber Essentials — boundary firewalls, secure configuration, security update management, and supported software — and the advisory is in effect a demonstration, at international scale, of why those foundations exist.

Where UK businesses are exposed

The rows below reflect where this risk typically sits in a UK SME, with badges indicating how much attention each usually needs.

The fifth row is where most of the risk quietly accumulates. A CCTV installer, an alarm company, a phone system supplier or the person who set up the office network years ago may each have left a device on the internet. None of them is responsible for keeping it updated unless a contract says so, and usually nothing does. Those devices then outlive the relationship with the supplier who installed them, and become nobody’s job. Establishing who owns each internet–facing device — and whether it still receives updates — is the single most productive exercise most small businesses can do in response to this advisory.

The seventh row deserves explanation because it describes how a conscripted device is most often spotted. A camera or storage box normally sends very little traffic outward. If one begins making large numbers of outbound connections to unfamiliar destinations, that is a strong sign it is being used for something else. Many business firewalls and managed routers can show this; few businesses ever look. A periodic glance at which internal devices are talking most to the outside world is a cheap way to find a problem that otherwise stays invisible.

What reducing your exposure costs

The bands below are indicative planning figures for UK businesses addressing internet–exposed device risk — not quotes.

The first and last rows cover most readers and are close to free. The largest single cost many businesses will face is replacing a router or appliance that no longer receives security updates. That is worth doing regardless of this advisory, because an unsupported edge device cannot be fixed when the next flaw is published, and in the meantime it is exactly the kind of equipment that ends up in other people’s botnets.

Two ways to run the edge of your network

Most of what separates those columns is attention rather than money. The inventory, the password changes, the closed ports and the VPN for remote viewing are configuration work. The one item with a real cost is replacing unsupported hardware, and that cost arrives eventually whether a business chooses the timing or a compromise chooses it instead. What the advisory adds is urgency: the scanning that finds these devices is automated and continuous, and the actors using what it finds are, on the advisory’s account, well resourced and persistent.

Why a state–linked advisory matters to a small business

It is reasonable for a small UK business to doubt that it is of interest to actors described in an advisory co–sealed by nine agencies. In terms of being a deliberate target, that doubt may well be justified. The flaw in the reasoning is that targeting is not the only way such activity touches small organisations. Large–scale botnets need large numbers of devices, and those devices come from everywhere. Automated scanning does not check who owns an address before probing it. And confidential data is not held only by large organisations: suppliers, contractors and professional advisers to critical sectors hold sensitive information too, and are often easier to reach.

The supply chain dimension deserves particular weight. The advisory says the activity extends to critical sectors. Businesses that supply, maintain or advise organisations in those sectors may hold access, credentials or data that makes them a useful route in, regardless of their own size. For such businesses, the controls in this article are increasingly something clients will ask about directly, and Cyber Essentials certification is frequently the minimum expected. The advisory gives those questions sharper context.

There is also a reputational aspect that is easy to overlook. If a device on your connection is used to attack someone else, the logs at the receiving end show your IP address. In most cases the victim and investigators will understand what a conscripted device is. But the first experience of it for many businesses is a blocklisted connection, an abuse report from their provider, or a question from a client — none of which is a comfortable way to discover that a camera installed five years ago was never updated.

Finally, the repeat naming of Integrity Tech is a useful corrective to a common assumption: that public exposure ends a threat. The company was named in September 2024 and named again, with a broader set of capabilities, in October 2026. Persistent, well–resourced actors adapt rather than stop. That is why defences grounded in reducing exposure and keeping devices supported hold their value over time, while defences that depend on a particular campaign being disrupted do not.

The story at a glance

This story connects to several we have covered recently. The NCSC and FSB router advisory from July is the essential companion: it addressed exactly the small–business routers that end up in networks of compromised devices. The actively exploited Citrix NetScaler flaws show what happens to edge appliances that are not patched promptly. The Gemini autonomous hacking research and NCSC adversary simulation work and OpenAI notifying 100–plus organisations about its agents both concern the automated reconnaissance this advisory now attributes to state–linked actors. The JadePuffer attackers hijacking Azure identities illustrates the hours of quiet reconnaissance that precede damage. And the ASOS push–notification breach is a reminder of how quickly an organisation can find itself responding to something it cannot yet fully see.

Frequently asked questions

CloudSwitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.