US Sanctions on Chinese Firm Over Flax Typhoon Cyberattacks
Last Updated: August 17, 2026
The United States sanctioned Beijing-based cybersecurity company Integrity Technology Group, Incorporated on January 3, 2025, after U.S. authorities linked its infrastructure to computer intrusions attributed to the Chinese state-sponsored threat group known as Flax Typhoon.
The U.S. Department of the Treasury sanctioned Integrity Technology Group through the Office of Foreign Assets Control, or OFAC, under U.S. cyber sanctions authorities.
The case goes beyond sanctions policy. U.S. investigators linked the wider operation to a large network of compromised routers, firewalls, network-attached storage systems, and other Internet of Things devices. A joint U.S. cybersecurity advisory reported that the botnet included more than 260,000 compromised devices as of June 2024.
The international response later expanded. In March 2026, the Council of the European Union sanctioned Integrity Technology Group as part of restrictive measures related to malicious cyber activity.
For businesses, the case highlights a practical security problem: attackers do not always need unknown vulnerabilities or unusual malware. Known software flaws, exposed network devices, poorly secured remote access, and compromised IoT equipment can provide useful paths into an environment.
Why Did the US Sanction Integrity Technology Group?
The U.S. Treasury said Flax Typhoon actors used infrastructure associated with Integrity Technology Group during computer network exploitation activities between the summer of 2022 and fall of 2023.
According to the Treasury, the actors regularly exchanged information with infrastructure linked to Integrity Tech while conducting their operations.
The official OFAC designation identifies Integrity Technology Group, Incorporated, also known through several related names, under the CYBER2 sanctions program.
The Treasury describes Flax Typhoon as a Chinese state-sponsored malicious cyber group active since at least 2021. U.S. authorities say the group has compromised networks across North America, Europe, Africa, and Asia, with particular focus on Taiwan.
The group has also targeted organizations connected to critical infrastructure.
This is important for businesses because an attack does not have to start with a sophisticated zero-day vulnerability. A publicly exposed system running vulnerable software can sometimes provide the initial opportunity an attacker needs.
Maintaining a clear picture of exposed systems through attack surface management can help organizations identify forgotten services, public-facing systems, exposed remote-access portals, and other assets that may increase their risk.
How Flax Typhoon Gains Access to Networks
The techniques described by U.S. authorities show why basic security weaknesses remain valuable to advanced attackers.
Flax Typhoon has been reported to exploit publicly known vulnerabilities to gain initial access to target systems. After entering an environment, the actors may use legitimate administrative and remote-access software to maintain access.
That approach creates a detection challenge.
A traditional malware alert may not trigger when an attacker uses software that administrators also use legitimately. Security teams therefore need to understand what normal remote administration looks like inside their environment.
Organizations should know:
- Which remote-access services are enabled
- Who is allowed to use them
- Which systems can be accessed remotely
- Whether Remote Desktop Protocol is exposed unnecessarily
- Which VPN accounts have privileged access
- Whether login activity appears from unusual locations or devices
- Whether old accounts remain active
- Whether multi-factor authentication protects remote access
These checks should form part of a broader cyber security assessment, especially where businesses operate Internet-facing infrastructure or rely heavily on remote administration.
The Integrity Tech Botnet Connection
The botnet linked to the investigation provides another important part of the story.
A joint U.S. cybersecurity advisory on the compromised routers and IoT devices described infrastructure that U.S. authorities associated with Integrity Technology Group.
According to the advisory, the botnet had been active since around mid-2021 and contained more than 260,000 compromised devices as of June 2024.
Affected systems included:
- Small-office and home-office routers
- Firewalls
- Network-attached storage devices
- Internet of Things equipment
- Other Internet-connected network devices
The infrastructure used a customized version of Mirai-family malware.
Mirai is a malware family designed to compromise Internet-connected devices and turn them into remotely controlled systems. Once enough devices are compromised, attackers can use the resulting network for different malicious purposes.
The advisory describes attackers exploiting known vulnerabilities before establishing command-and-control communication with infected equipment.
This reinforces why organizations should treat routers and IoT devices as security-sensitive infrastructure rather than simple appliances.
Hoplon Infosec's guidance on how to protect IoT devices from botnet attacks provides additional context for organizations reviewing this type of exposure.
Supported Devices Can Still Be Compromised
One detail from the joint advisory deserves particular attention.
Older, unsupported devices are an obvious security concern, but compromised devices were not limited to end-of-life equipment.
Some affected systems were likely still supported by their manufacturers.
That distinction matters.
Replacing unsupported hardware is necessary, but simply using supported equipment does not make an environment secure.
Businesses still need to:
- Install firmware and security updates
- Change default credentials
- Disable unnecessary services
- Restrict administrative access
- Monitor suspicious network traffic
- Segment devices from sensitive systems
- Review configuration changes
- Maintain an accurate device inventory
Understanding common Internet of Things vulnerabilities can also help IT teams identify weaknesses that are easy to overlook when connected devices are deployed.
The FBI Disrupted the Botnet
In September 2024, U.S. authorities announced a court-authorized operation targeting the botnet.
The FBI's botnet disruption operation disconnected compromised infrastructure from the China-based operators identified during the investigation.
According to the FBI, the operation used the malware's own functionality to send commands designed to remove malicious components from infected systems.
The disruption was an important law-enforcement action, but businesses should not interpret it as evidence that all Flax Typhoon-related risk disappeared.
Individual organizations can still have vulnerable devices, exposed systems, stolen credentials, poor segmentation, or compromised infrastructure.
A disrupted command-and-control system does not automatically correct the underlying security weaknesses that allowed a device to be compromised.
Why Routers and IoT Devices Matter
Routers and IoT equipment can be attractive targets because they often receive less security attention than laptops and servers.
A business may have strong endpoint protection on employee computers while a router, camera, network storage device, or other connected appliance quietly runs outdated firmware.
These devices may also operate continuously.
That makes visibility important.
An IT team should be able to answer:
- What Internet-connected devices do we own?
- Which devices can be reached from outside our network?
- What firmware versions are installed?
- Are security updates still available?
- Which devices use default or weak credentials?
- Which administrative interfaces are publicly accessible?
- Which systems can communicate with sensitive internal networks?
If the organization cannot answer those questions, the first problem is often asset visibility.
An external attack surface review can help identify public-facing systems that internal teams may have forgotten or may not realize are accessible from the Internet.
Network Segmentation Can Limit the Damage
Preventing every compromise is difficult, so organizations should also limit what happens after one device is breached.
Network segmentation separates systems according to their purpose and security requirements.
For example, an Internet-connected camera usually does not need unrestricted access to:
- Finance systems
- Employee workstations
- Domain controllers
- Customer databases
- Backup servers
- Administrative networks
Separating these systems reduces unnecessary communication paths.
If attackers compromise a low-trust IoT device, segmentation can make it harder for them to move deeper into the environment.
This is particularly important when organizations operate large numbers of connected devices.
Review VPN and Remote Desktop Access
Remote access is another important area to review.
The Treasury's description of Flax Typhoon activity includes the use of VPN software and Remote Desktop Protocol.
Both technologies have legitimate business uses.
The problem occurs when remote access is exposed unnecessarily, weakly protected, poorly monitored, or available through compromised credentials.
Organizations should review:
- Which VPN gateways are Internet-facing
- Whether their software and firmware are current
- Whether multi-factor authentication is required
- Which users have remote-access privileges
- Whether inactive accounts have been disabled
- Whether RDP is exposed directly to the Internet
- Whether unusual login activity is monitored
- Whether privileged remote sessions generate appropriate logs
Remote access should provide the minimum level of access required for the user's role.
What the US Sanctions Actually Mean
The sanctions also have consequences outside cybersecurity operations.
Under OFAC rules, property and interests in property belonging to the designated company that fall within U.S. jurisdiction are generally blocked.
Certain entities owned 50 percent or more by blocked persons may also be treated as blocked under OFAC rules.
U.S. persons are generally prohibited from engaging in transactions involving blocked property or interests in property unless an exemption or OFAC authorization applies.
Businesses should be careful not to overgeneralize this point.
The designation does not mean that every foreign organization that has any connection with Integrity Technology Group automatically receives a U.S. penalty.
Sanctions obligations depend on factors such as the parties, ownership, transaction, jurisdiction, and applicable authorizations.
Organizations facing an actual sanctions question should review current OFAC requirements and obtain suitable legal or compliance advice.
The European Union Also Took Action
The case did not end with the January 2025 U.S. designation.
On March 16, 2026, the Council of the European Union announced restrictive measures against Integrity Technology Group.
The Council stated that the company had provided products used to compromise devices within EU member states, elsewhere in Europe, and internationally.
The EU said more than 65,000 devices across six member states were hacked between 2022 and 2023 with alleged technical and material support connected to the company.
The EU action demonstrates how concerns surrounding the infrastructure expanded beyond the United States.
What Businesses Should Check
The most valuable response for businesses is not simply following the sanctions story.
Organizations should use the technical details to review their own exposure.
1. Inventory Internet-Facing Devices
Identify routers, firewalls, VPN gateways, storage systems, remote-access servers, cameras, and IoT equipment accessible from the Internet.
Do not assume the existing inventory is complete.
2. Patch Firmware and Software
Check manufacturer security updates and apply supported patches.
Prioritize devices with known exploited vulnerabilities or direct Internet exposure.
3. Replace Unsupported Equipment
A device that no longer receives security updates creates an ongoing maintenance problem.
Create a replacement plan for end-of-life network and IoT hardware.
4. Remove Default Credentials
Default usernames and passwords should not remain active.
Use unique, strong administrative credentials and multi-factor authentication where supported.
5. Disable Unnecessary Services
If remote administration, file sharing, automatic configuration, or another exposed service has no business purpose, disable it.
Reducing unnecessary services reduces the available attack surface.
6. Segment IoT Infrastructure
Keep low-trust connected devices away from sensitive systems wherever the architecture allows it.
Only permit the communication required for the device to perform its intended function.
7. Monitor Network Activity
Unusual outbound traffic, repeated connections, unexplained bandwidth spikes, and unexpected administrative sessions may justify investigation.
Baseline normal network behavior so unusual activity is easier to recognize.
8. Review Remote Access
Audit VPN accounts, RDP configuration, administrative portals, and remote-management software.
Remove unnecessary accounts and investigate unexplained access.
When a Security Assessment Becomes Useful
A checklist can identify obvious weaknesses, but some security questions require deeper testing.
For example:
- Can an exposed device provide access to another network segment?
- Can several small weaknesses be chained together?
- Is an administrative interface reachable from the Internet?
- Can an attacker move from IoT infrastructure to sensitive systems?
- Would monitoring detect unusual remote access?
- Are firewall rules providing the isolation administrators expect?
- Are critical systems exposed through forgotten infrastructure?
A structured cyber security assessment can help organizations review their environment, identify vulnerabilities, understand risk, and decide what requires attention first.
Where controlled exploitation is appropriate, infrastructure penetration testing can go further by evaluating whether weaknesses in network infrastructure could actually be used during a realistic attack scenario.
Penetration testing should not be treated as a guarantee that future attacks cannot occur. Its purpose is to identify weaknesses under a defined scope and provide evidence that helps organizations improve their defenses.
What a Good Security Review Should Cover
For an environment concerned about attack paths similar to those highlighted in the Flax Typhoon investigation, a useful review may include:
- External asset discovery
- Internet-facing service identification
- Vulnerability assessment
- Router and firewall configuration review
- VPN security checks
- Remote-access review
- Network segmentation testing
- IoT exposure assessment
- Credential and authentication controls
- Patch-management review
- Security logging
- Detection capabilities
- Privileged-access controls
The exact scope should depend on the organization's infrastructure and risk rather than using the same checklist for every company.
What the Integrity Tech Case Teaches Security Teams
The U.S. sanctions on the Chinese firm are significant from a geopolitical and enforcement perspective, but the defensive lesson is much more practical.
The activity described by authorities involved familiar technologies:
- Known software vulnerabilities
- Routers
- IoT equipment
- VPN connections
- Remote Desktop Protocol
- Legitimate remote-access software
- Internet-facing infrastructure
That means part of the defense comes from disciplined security fundamentals.
Organizations should know what they expose to the Internet, keep supported equipment updated, replace unsupported devices, restrict remote access, separate lower-trust systems, and monitor unusual activity.
For organizations that cannot confidently determine whether these controls are working as intended, a professional security assessment can provide a more structured view of the environment.
Hoplon Infosec provides cyber security assessment and infrastructure penetration testing services that can help organizations identify weaknesses and prioritize remediation based on their actual environment.
The goal is not to promise protection against a specific threat group. It is to reduce avoidable exposure and make it harder for attackers to turn ordinary security weaknesses into a larger compromise.
For more:
