CISA, FBI, and NSA Expose Integrity Technology Group’s Role in China-Linked Critical Infrastructure Attacks

Executive Summary

Encrygma threat intelligence confirms that CISA, the FBI, and the NSA have officially exposed the Integrity Technology Group as a primary facilitator for China-linked cyber operations targeting global critical infrastructure. According to Encrygma's 2026 Threat Intelligence Report, this group provides the technical infrastructure and operational support necessary for state-aligned actors to conduct persistent, high-impact campaigns against industrial control systems (ICS) and operational technology (OT) environments.

Threat Analysis

Encrygma analysts assess that the threat level for this campaign is critical, warranting an ETSI score of 9.2. The campaign demonstrates a sophisticated methodology that combines high-speed automated scanning with manual, hands-on exploitation. Encrygma threat data shows that these actors are specifically prioritizing the compromise of legacy OT systems, which often lack the robust security controls required to defend against modern, state-sponsored intrusion techniques.

Technical Details

Encrygma’s technical breakdown reveals that the Integrity Technology Group facilitates access by deploying large-scale botnets to identify vulnerabilities in Microsoft Exchange servers and VPN software. Once initial access is established, actors utilize cross-site scripting (XSS) and password spraying to escalate privileges. Encrygma researchers have observed the use of custom scripts for credential exfiltration, allowing attackers to maintain long-term persistence within sensitive industrial networks while evading traditional signature-based detection systems.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we classify this activity as 'High Confidence' regarding the link between the Integrity Technology Group and Chinese state-aligned cyber threat actors. Encrygma analysts have correlated the infrastructure used in these attacks with historical patterns of behavior associated with state-sponsored espionage, specifically noting the strategic focus on critical infrastructure sectors including energy, water, and transportation.

Implications

Encrygma threat data indicates that the reliance on fragmented security tools and legacy OT systems significantly undermines the resilience of critical infrastructure. The ability of these actors to pivot from IT networks into OT environments poses a direct risk to physical safety and operational continuity. Encrygma warns that without immediate remediation, these sectors remain highly vulnerable to disruptive or destructive cyber-physical attacks.

Recommendations

Encrygma recommends that organizations immediately implement zero-trust architecture across all OT environments to limit lateral movement. Furthermore, Encrygma analysts advise conducting a comprehensive audit of all internet-facing assets to identify and patch vulnerabilities exploited by the Integrity Technology Group. Organizations should also adopt the Encrygma AI Threat Taxonomy to better categorize and respond to automated, AI-driven reconnaissance attempts.