US sanctions Chinese cybersecurity firm over attacks

The US Treasury has imposed sanctions against Chinese cybersecurity player Integrity Technology Group, claiming it has been involved in multiple hacking incidents targeting critical US infrastructure.

The move comes a few days after the Treasury reported that a cyberattack – claimed to be sanctioned by the Chinese state – had compromised several of its workstations and gained access to unclassified documents. Beijing has hit back at the accusations, calling them "groundless."

News of that cyberattack emerged when third-party software service provider BeyondTrust reported that hackers had stolen a key used to secure a cloud-based service that provided remote technical support to workers.

The Treasury makes no direct connection between the hacking incident in its announcement of the ITG sanctions, but indicates that the company has played a role in "multiple computer intrusion incidents against US victims" as well as groups in Europe, Africa, and Asia.

Those attacks have been publicly attributed to Flax Typhoon, described by the Treasury as "a Chinese malicious state-sponsored cyber group that has been active since at least 2021, often targeting organisations within US critical infrastructure sectors."

The sanctions block ITG's access to US property and bank accounts and prevent the company and its representatives from doing business with US organisations.

"The Treasury Department will not hesitate to hold malicious cyber actors and their enablers accountable for their actions," said Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley Smith.

A National Threat Assessment published (PDF) by the Office of the Director of National Intelligence in 2024 concluded that Chinese malicious cyber actors "continue to be one of the most active and most persistent threats to US national security."