4th January 2025 – (Washington) On Friday, the Treasury Department announced sanctions against Integrity Technology Group, a Beijing-based cybersecurity firm, for its role in aiding Chinese hackers in infiltrating U.S. communications systems and conducting surveillance worldwide. The sanctions come amid growing concerns over cybersecurity threats posed by state-sponsored actors.
The Treasury’s statement highlights that Integrity Technology Group supported the Flax Typhoon hacking group, which is believed to have targeted foreign networks between the summer of 2022 and 2023. Investigations revealed that Flax Typhoon routinely exchanged information using Integrity Tech’s infrastructure.
This announcement follows a troubling letter to lawmakers earlier this week, revealing that a Chinese intelligence agency had breached the Treasury Department’s systems, accessing the workstations and unclassified documents of government employees. However, it remains unclear whether Flax Typhoon was involved in this specific attack.
In recent months, the threat from Chinese state-sponsored cyber actors has been underscored by the Office of the Director of National Intelligence, which identified them as a persistent danger to U.S. national security. The Treasury’s acting undersecretary, Bradley T. Smith, stated, “The Treasury Department will not hesitate to hold malicious cyber actors and their enablers accountable for their actions.”
Flax Typhoon has been active since at least 2021, targeting U.S. critical infrastructure sectors and compromising networks across North America, Europe, Africa, and Asia. The group exploits known vulnerabilities to gain initial access and uses legitimate remote access software to maintain control over compromised networks.
In September, the FBI dismantled a network of 200,000 consumer devices that Flax Typhoon had compromised with malware. The sanctions against Integrity Technology Group prohibit U.S. financial institutions and individuals from conducting transactions with the company and freeze any assets it holds in the United States.
Under the sanctions, all property and interests belonging to the designated entity that are located in the U.S. or under U.S. control are blocked. Furthermore, any entities owned 50% or more by the sanctioned firm are also affected. Engaging in transactions with the designated firm could expose individuals and institutions to further sanctions or enforcement actions.
