US Sanctions Chinese Cyber Firm Tied to Flax Typhoon Hacking Operations
The U.S. government has imposed sanctions on a Beijing-based cybersecurity firm, Integrity Technology Group, due to its alleged connections with the China-backed hacking group known as Flax Typhoon. These sanctions highlight ongoing concerns regarding cybersecurity threats originating from state-sponsored actors.
Sanctions Against Integrity Technology Group
On Friday, the Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions against Integrity Technology Group, also referred to as Yongxin Zhicheng. This action is a response to the company’s involvement in “numerous computer intrusion incidents impacting U.S. victims,” including critical infrastructure.
Connection to Flax Typhoon Hacking Group
The sanctions come several months after U.S. authorities accused Integrity Technology of managing a botnet linked to the Flax Typhoon hacking group. In September, the FBI successfully dismantled this botnet, which had compromised over 260,000 internet-connected devices, such as cameras, routers, and storage devices. According to a joint advisory from the FBI and the National Security Agency (NSA), Integrity Technology had been controlling this botnet since 2021 to obscure the activities of the hackers.
Impact on U.S. and European Organizations
The Treasury’s announcement revealed that Flax Typhoon utilized infrastructure associated with Integrity Technology to breach several U.S. and European organizations between mid-2022 and late-2023. Notably, the hacking group compromised “multiple servers and workstations at a California-based entity,” although specific victims were not disclosed.
Targets of the Hacking Group
According to a separate press release from the U.S. Department of State, Flax Typhoon successfully infiltrated:
- Multiple U.S. universities
- Government agencies
- Telecommunications providers
- Media organizations
Recent Cyberattacks and National Security Concerns
The recent sanctions come shortly after the Treasury confirmed it experienced a cyberattack in December attributed to Chinese state-sponsored hackers. This attack specifically targeted the Treasury’s sanctions office, OFAC, allowing hackers remote access to employees and unclassified documents.
U.S. officials indicated to The Washington Post that the breach could have provided hackers with sensitive information regarding Chinese entities that might be considered for financial sanctions.
Ongoing Threats from Chinese Cyber Actors
A spokesperson for the Treasury has not responded to inquiries from TechCrunch. Nonetheless, the Treasury has described Chinese malicious actors as “one of the most active and persistent threats” to U.S. national security, particularly in light of their targeting of the Treasury’s IT infrastructure.
Integrity Technology Group, which is publicly traded on the Shanghai Stock Exchange, has yet to comment on this matter.
