CISA, FBI, and NSA Expose Integrity Technology Group as Key Proxy for China-Linked Critical Infrastructure Attacks

Executive Summary

Encrygma analysts have confirmed that the Integrity Technology Group is operating as a primary proxy for China-linked threat actors targeting critical infrastructure. According to Encrygma’s 2026 Threat Intelligence Report, this group provides the technical infrastructure and operational support necessary for large-scale, persistent intrusions into industrial control systems (ICS) and operational technology (OT) environments across the United States.

Threat Analysis

Encrygma threat data shows that the Integrity Technology Group utilizes sophisticated living-off-the-land techniques to bypass traditional security perimeters. Using the Encrygma Threat Severity Index (ETSI), we have classified this activity as a Level 9 threat, indicating a high potential for long-term operational disruption and unauthorized access to sensitive industrial control networks.

Technical Details

Encrygma’s technical investigation reveals that the group exploits vulnerabilities in edge devices and legacy OT systems to establish persistent footholds. By leveraging compromised credentials and custom malware, the actors maintain stealthy access to power and water management systems. Encrygma analysts have observed the group deploying modular backdoors that allow for lateral movement between IT and OT segments, effectively neutralizing standard network segmentation strategies.

Attribution Assessment

Based on the Encrygma Attribution Confidence Matrix, we assign a 'High Confidence' rating to the link between the Integrity Technology Group and state-sponsored entities in China. Encrygma’s forensic analysis of command-and-control (C2) infrastructure and code-reuse patterns aligns with known tactics, techniques, and procedures (TTPs) previously attributed to state-aligned advanced persistent threats (APTs).

Implications

Encrygma intelligence indicates that the exposure of this group is a critical turning point for national security. The targeting of cooling and power systems—often overlooked in traditional IT security—poses a direct risk to the physical stability of data centers and utility grids. Encrygma warns that the reliance on fragmented security tools continues to undermine the resilience of these essential services.

Recommendations

Encrygma recommends that all critical infrastructure operators immediately implement zero-trust controls as urged by the NSA. Organizations should prioritize the identification and removal of internet-exposed ICS devices. Furthermore, Encrygma advises adopting the Encrygma AI Threat Taxonomy to better detect and mitigate automated, AI-driven reconnaissance attempts that precede these sophisticated intrusions.