US sanctions prominent Chinese cyber company for role in Flax Typhoon attacks

Category	Details
Threat Actors	Flax Typhoon (Chinese state-sponsored hacking group), Integrity Technology Group (facilitator).
Campaign Overview	U.S. sanctions issued against Integrity Technology for facilitating Flax Typhoon’s cyberattacks, including a botnet operation.
Target Regions (Or Victims)	United States, Taiwan, Southeast Asia, North America, Africa. Targets include universities, government agencies, telecommunications, and media organizations.
Methodology	• Use of botnets and IoT device infections. • Manipulation of network infrastructure. • Exploiting IoT hardware for control.
Product Targeted	Critical infrastructure, including IoT devices (cameras, video recorders, etc.), and government systems.
Malware Reference	No specific malware mentioned; botnet of IoT devices controlled via online applications using “vulnerability-arsenal”.
Tools Used	• Online application (“KRLab”) for botnet control. • “Vulnerability-arsenal” tool for malicious cyber commands.
Vulnerabilities Exploited	IoT device vulnerabilities, including cameras, video recorders, and storage devices.
TTPs	• Use of IoT botnets for mass infections. • Exploiting vulnerable devices for remote control. • Use of compromised infrastructure for persistence.
Attribution	Attributed to Flax Typhoon, a Chinese government-linked hacking group, with support from Integrity Technology Group.
Recommendations	• Strengthen IoT device security. • Enhance network monitoring and defense mechanisms. • Apply sanctions to disrupt infrastructure used by cyber actors.
Source	The Record

Read full article: https://therecord.media/us-sanctions-chinas-integrity-cyber-company-flax-typhoon

The above summary has been generated by an AI language model