The Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced on Jan. 3 that it has imposed sanctions on a Beijing-based cybersecurity company known as Integrity Technology Group, Inc. (Integrity Tech) for its role in a spate of malicious cyber activities.
The agency said Integrity Tech is linked to the state-sponsored hacking group Flax Typhoon, which often targets organizations within U.S. critical infrastructure sectors.
“The Treasury Department will not hesitate to hold malicious cyber actors and their enablers accountable for their actions,” said Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley Smith. “The United States will use all available tools to disrupt these threats as we continue working collaboratively to harden public and private sector cyber defenses.”
Flax Typhoon has been active since at least 2021, but the FBI announced in September 2024 that it had successfully taken the hacking group offline.
According to FBI Director Christopher Wray, the hacking group represents itself as Integrity Tech but “their chairman has publicly admitted that for years his company has collected intelligence and performed reconnaissance for Chinese government security agencies.”
“Flax Typhoon was targeting critical infrastructure across the U.S. and overseas, everyone from corporations and media organizations, universities, government agencies,” Wray said. “And like Volt Typhoon, they used internet connected devices, but this time, hundreds of thousands of them, to create a botnet that helped them compromise systems and exfiltrate confidential data.”
Yet unlike Volt Typhoon, Wray said that Flax Typhoon hijacked internet of things devices such as cameras or storage devices.
The announcement of sanctions came just days after the Treasury Department revealed it had been a victim of a China state-sponsored breach of some of the department’s sensitive systems.
