US and allied agencies name China's Integrity Tech as an enabler of global critical infrastructure intrusions

Naming a commercial contractor shows that state-linked intrusion capability is being supplied as a service, so the same tradecraft can surface across many sectors at once. Security leaders should treat internet-facing Exchange servers, VPN concentrators and unmanaged edge appliances as priority audit targets, and confirm that these devices feed logs into central monitoring. Living-off-the-land techniques leave little malware to find, which makes detection based on behaviour and authentication patterns more important than signature tools.

What Happened

On 8 October 2026, CISA, the FBI, the NSA and international partners issued joint advisory AA26-281A. It says Integrity Technology Group, a China-based cybersecurity company with ties to the Chinese government, is enabling threat actors to target critical infrastructure worldwide using botnets, VPN infrastructure and living-off-the-land techniques, including password spraying against Microsoft Exchange servers and targeting of poorly monitored edge devices. The Register reported that the US also disrupted Integrity Tech's hacking tools and that agencies from the US, UK, Australia, Canada, Japan, New Zealand and Spain joined the warning.

Why It Matters

Naming a commercial contractor shows that state-linked intrusion capability is being supplied as a service, so the same tradecraft can surface across many sectors at once. Security leaders should treat internet-facing Exchange servers, VPN concentrators and unmanaged edge appliances as priority audit targets, and confirm that these devices feed logs into central monitoring. Living-off-the-land techniques leave little malware to find, which makes detection based on behaviour and authentication patterns more important than signature tools.

Sources

• Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide (2026-10-08)
• Cybersecurity and Infrastructure Security Agency (opens in a new tab): Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (2026-10-08)
• The Register (opens in a new tab): US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide (2026-10-08)

More From This Briefing

• CISA expands Citrix NetScaler zero-day alert and urges patching of the full CVE set
• Anthropic releases Claude Haiku 5.5 and halves Sonnet 5.5 cache-read pricing
• EIOPA sets supervisory expectations for private equity-backed insurers, including reinsurance arrangements
• AMD's Lisa Su says CPU demand exceeds supply and plans a substantial supply increase in 2027

This story is part of the Laurenceo Intelligence briefing for 10 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.