Flax Typhoon-Linked Company Integrity Technology: a Competitor, Business Partner and Client of i-SOON

First i-SOON, then Integrity Tech: How many more Chinese information security companies lie behind Chinese state cyber threat campaigns?

On September 18, 2024, US and allied government agencies released a Joint Cyber Security Advisory (joint advisory) announcing the exposure and takedown of a China-linked botnet that had used thousands of compromised routers and Internet of Things (IoT) devices for malicious cyber activity. The joint advisory stated that a Chinese information security company, Integrity Technology Group (Integrity Tech) “has controlled and managed a botnet active since mid-2021….As of June 2024, the botnet consisted of over 260,000 devices,” with victim devices observed in North America, South America, Europe, Africa, Southeast Asia and Australia. The attribution section of the joint advisory stated that Integrity Technology has “links to the PRC government” and that the intrusions and activity linked to the botnet are “consistent with the tactics, techniques, and infrastructure associated with the cyber threat group known publicly as Flax Typhoon, RedJuliett, and Ethereal Panda.” In an unsealed US sea…