Flax Typhoon, Integrity Technology Group, and the Corporate Economics of State-Linked Cyber Operations
Analysis based on publicly available information as of October 12, 2026.
Abstract
On October 8, 2026, the U.S. Department of Justice and the FBI announced the seizure of seven internet domains associated with Integrity Technology Group, a Chinese cybersecurity company accused of supporting state-linked cyber operations. According to U.S. authorities, the domains supported MicroScan, a vulnerability-scanning platform, and FishHub, a tool associated with malware delivery and information theft. The infrastructure was linked to activity tracked as Flax Typhoon, including operations against U.S. critical infrastructure, Taiwanese universities, and other organizations worldwide. [1]
What makes this case unusual is the organization behind the alleged activity. Integrity Tech, known in Chinese as 永信至诚, is a publicly listed company that develops cyber ranges, vulnerability-assessment tools, and security training systems. The FBI recovered Sparrow source code and a user guide bearing the name KRLab, a research brand associated with the company. U.S. authorities allege that Integrity Tech sold customers the ability to control compromised devices and that its employees supported cyber operations. [1][2][3]
Corporate filings reveal the company’s legitimate research, contracts, suppliers, and finances. They do not reveal a customer ledger, pricing schedule, or payment trail for the alleged sale of botnet access. Investigators documented some operational infrastructure payments, but the relationship between those payments and corporate revenue remains unclear.
This investigation compares judicial records, technical advisories, and corporate disclosures to ask how cyber capabilities can be developed and operated inside a company, then allegedly sold to customers who use infrastructure they do not own. It traces the separation of production, control, financing, and use—and the legal and financial dependencies that could constrain the operation.
1. Incident Overview
The October 2026 seizures covered seven domains: c0cc.cc, 98aiblog.com, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, and linkedinns.net.
According to the Department of Justice, the domains served different functions within an intrusion-related infrastructure. One provided access to MicroScan. Another was associated with unauthorized remote access to compromised university networks. Five others facilitated malware delivery through FishHub. [1]
MicroScan was a Python-based web application containing more than 1,300 penetration-testing scripts. [3] Investigators described its use in reconnaissance against organizations that included a U.S. electricity provider, Taiwanese energy companies, universities, an international nongovernmental organization, and airports in Japan and Poland. The FBI associated scanning of two Taiwanese universities with subsequent unauthorized intrusions. A scanning record alone, however, does not establish that every identified target was compromised.
FishHub operated at a different stage. The Justice Department’s announcement places its malware delivery after an initial network compromise; the affidavit documents delivery through the five domains and subsequent file search and collection, without reconstructing that initial entry method. The recovered tools could establish remote access, locate files, and send information to external servers. The Justice Department identified approximately 20 Taiwanese universities as confirmed victims of activity associated with FishHub. [1]
The operation was not the first U.S. intervention against infrastructure attributed to Integrity Tech.
In September 2024, the Justice Department announced the disruption of a Mirai-based botnet comprising more than 200,000 compromised consumer devices. These Internet of Things (IoT) devices included routers, cameras, network-attached storage systems, and other internet-connected equipment. They were used to relay communications, conduct reconnaissance, and support malicious operations. [2]
At the top of this infrastructure was an application called Sparrow.
Sparrow provided a management interface through which authenticated users could issue commands to compromised devices. The application maintained information about infected systems and allowed operators to perform functions including file operations, remote command execution, and vulnerability-related tasks.
The FBI recovered Sparrow source code and a user guide containing the name KRLab, one of Integrity Tech’s publicly identified research brands. [1]
This connection matters. The attribution was not based solely on a resemblance between publicly advertised security products and malicious software. The company’s research identity appeared in technical material recovered from the operational infrastructure itself.
The Justice Department’s September 2024 announcement went further. The FBI stated that Integrity Tech was selling customers the ability to hack into and control compromised devices through an online application.
The October 2026 advisory likewise attributed several parts of the operational process to individuals employed by Integrity Tech, including tool development, infrastructure acquisition, hosting, and intrusion activity. [3]
These are official investigative assessments, not admissions by the company or judicial findings of individual criminal liability. The joint advisory also cautions that activity tracked under the names Flax Typhoon, Ethereal Panda, and Red Juliett does not map perfectly onto Integrity Tech: those clusters may include operations unrelated to the company.
The investigative record thus points beyond individual intrusions: U.S. authorities describe a company whose research identity appears in operational software and whose personnel allegedly developed, hosted, and used intrusion capabilities. How did those capabilities become repeatable services?
2. Attack Timeline
The technical history begins before the public disruptions.
Black Lotus Labs, the threat-research division of Lumen Technologies, traced the earliest identified campaign of the Raptor Train botnet to May 2020. The FBI’s investigations covered a partially overlapping period, with operational evidence extending through the September 2024 disruption. These are different observational scopes and should not be treated as a single uninterrupted record of every system’s activity. [2][8]
| Period | Observed activity |
|---|---|
| May 2020–April 2022 | Black Lotus Labs identifies Crossbill, the earliest observed Raptor Train campaign |
| 2021 onward | Botnet activity and intrusion operations documented in subsequent investigations |
| April–December 2022 | MicroScan reconnaissance against U.S., Taiwanese, Japanese, Polish, and other targets |
| August 2022 | Scanning of a university in Puli, Taiwan, followed by an intrusion described by the FBI |
| March 2023 | Scanning of a university in Hsinchu, Taiwan, followed by an intrusion described by the FBI |
| 2023–2024 | Expansion and maintenance of the multi-tiered IoT botnet |
| March 2024 | Registration of domains later associated with FishHub and related activity |
| August 2024 | Unauthorized access and SoftEther-based remote connections involving Taiwanese university networks |
| September 2024 | FBI disruption of the Mirai-based botnet |
| 2025–2026 | Provider records and technical observations connect previously investigated MicroScan infrastructure with later activity |
| February–March 2026 | Renewal of related domains and investigation of FishHub infrastructure |
| October 8, 2026 | Public announcement of the seizure of seven domains |
The timeline brings the operation’s maintenance burden into view. MicroScan identified potential targets; compromised IoT devices supplied scanning and proxy resources; servers and domains had to be provisioned or renewed.
Black Lotus Labs reconstructed Raptor Train as a three-tier system. Tier 1 consisted of compromised consumer and small-business devices. Tier 2 comprised exploitation, command-and-control, and payload-delivery servers, largely hosted on commercial virtual private servers (VPS). Tier 3 contained management systems, including Sparrow. Tasks initiated through Sparrow passed through Tier 2 control servers before reaching compromised devices. [8]
This infrastructure was highly dynamic. Black Lotus Labs measured an average active lifetime of approximately 17 days for compromised Tier 1 devices and roughly 77 days for higher-level nodes. The researchers also observed that administrative activity tended to coincide with weekday working hours in China. [8]
Most of the observed Nosedive implants ran only in memory and lacked a persistence mechanism, according to Black Lotus Labs. [8] With Tier 1 access lasting about 17 days on average, a fixed set of infections could not sustain the network. Operators had to recruit replacements, maintain command servers, and update software. That tempo is consistent with organized maintenance, though it does not identify the operators or their employment arrangements.
The September 2024 FBI operation intervened in precisely this control structure.
Under court authorization, the FBI took control of relevant infrastructure, changed configurations, and sent disabling commands that severed connections between compromised devices and the botnet’s control servers. During the operation, the infrastructure being used by the FBI was itself targeted by a distributed denial-of-service attack. The Justice Department reported that the attempt did not prevent the disruption. [2]
The disruption severed a control channel; it did not necessarily destroy software, data, or technical knowledge that could support later activity.
The October 2026 affidavit documented a concrete connection across the two investigations. An IP address associated with the previously examined MicroScan infrastructure remained linked, through provider records and a matching login interface, to x.c0cc.cc in 2026. The affidavit also described separate VPS and domain-registration accounts involved in later operations. [1]
The record does not establish continuous operation of every component or the same personnel across both investigations. It does show why the ability to maintain and replace infrastructure matters beyond any one server.
3. The Attacker as a Company
3.1 From technical research to reusable capabilities
Integrity Technology Group was established in 2010 and developed a business around cybersecurity training, cyber ranges, vulnerability assessment, and related services. Its October 2022 listing on the Shanghai Stock Exchange’s STAR Market gave it access to public equity financing while placing its products, finances, management, and major contracts within a corporate disclosure framework. [5]
Software copyright registrations disclosed in its IPO prospectus included internet-scale exploration, anonymous communication, remote management, network relaying, email forensics, cyber-operation management, and embedded-device vulnerability research dating from 2015 and 2016.
A registration does not establish a product’s practical capabilities or its use in an intrusion. It does show that Integrity Tech had organized related functions into development assets well before the FBI’s public attribution.
KRLab formed part of this technical organization. The company presented it as a research team working on operating-system security, web penetration testing, malware analysis, and automation. [5]
By the end of 2025, Integrity Tech employed 215 R&D personnel, representing 52.83% of its 407 employees. Its annual R&D expenditure was RMB 87.41 million, approximately 31.63% of reported revenue. [4]
Research capacity matters here because a company’s work does not disappear when one project ends. Source code, testing infrastructure, documentation, and expertise can be retained by an organization, maintained by existing staff, and reused in later work without rebuilding them for every customer or operation. The disclosed workforce and registrations show that Integrity Tech had the means to hold such assets over time; they do not show which assets were assigned to an unauthorized operation.
The KRLab material recovered from Sparrow supplies a technical link to the investigated infrastructure. It does not identify Sparrow’s internal funding, approver, or contract.
3.2 Selling an operational capability rather than a program
Integrity Tech’s disclosed government business provides a concrete example of how technical capabilities can be packaged for use by another organization.
One of its products was described as a case-lead tracking cyber range, or 案件线索追踪实战靶场. Despite the cyber-range terminology, the platform was presented as a system for supporting practical law-enforcement investigations, not merely simulated training.
The company’s IPO review responses described a system in which external network routes were centrally managed, virtual workspaces were assigned to individual investigators, and tools, records, and task resources could be allocated according to operational requirements. [6]
A supervising officer could organize teams, assign tasks, and allocate working environments. Individual operators could log in and perform work within their designated resources. The system was designed to record activity and manage results.
A standalone tool serves an operator. The disclosed platform addressed the agency’s larger problem: a supervisor could allocate work and resources, individual investigators could perform assigned tasks, and the organization could retain the resulting records. The developer, the person managing tasks, and the person using a tool occupied different roles. An agency using that environment did not need to own its source code or build each supporting component itself.
Integrity Tech disclosed projects of this kind for public-security customers including authorities in Nanjing, Guangzhou, and Shanxi. A December 2021 IPO review response listed approximately RMB 45.25 million in unrecognized revenue from outstanding orders within the case-lead tracking cyber-range category. This was an order backlog, not cash received or accumulated profit.
These were disclosed as legitimate government products. In September 2024, the FBI alleged that Sparrow gave customers an interface to operate compromised devices. If correct, the resemblance is in the commercial relationship: a provider maintains an environment while another party receives defined operational access through it. The government platform does not establish how Sparrow was built or sold, and no public record shows that the products shared code, accounts, or infrastructure.
3.3 Buying capabilities from other companies
Integrity Tech did not develop every component of its customer-facing systems internally.
The company’s IPO prospectus disclosed substantial purchases of external software and technical services. In 2020, these purchases represented 60.29% of the cost of its principal business activities. The figure included ordinary systems integration, equipment-related work, and other services; it was not a measure of spending on offensive cybersecurity tools. [5]
In 2020, Integrity Tech purchased RMB 2.3742 million in network tracing and source-attribution-related systems from Anhui Yun Tansuo Network Technology. The prospectus explained that its tracing services required numerous external nodes, and that the purchased system enabled instructions to be sent to nodes associated with the supplier.
It also purchased RMB 849,100 in tracing-node resources and services from Shenzhen Lingtian Technology. Pricing was based on factors such as the quantity of resources and the period of use.
The procurement describes a system with several parties. Suppliers provided node resources and services; Integrity Tech bought access to those resources and incorporated them into a customer-facing tracing capability. A government customer could specify requirements and buy the integrated system from one contractor rather than negotiate separately with each specialist supplier. Integrity Tech, in turn, had to procure, configure, deliver, and support what it sold. Pricing by node quantity and period of use made the outside resource an ongoing input, not merely a one-time software purchase.
The Chinese term suyuan (溯源) refers broadly to tracing or attribution. Nothing in these records identifies the nodes as compromised devices or connects the suppliers to Raptor Train. The records instead show how a legitimate capability could cross a supplier boundary while remaining available to a customer through one integrator.
3.4 Government and military contracting
Integrity Tech’s customer disclosures extend beyond municipal public-security agencies.
The company’s prospectus identified Kunshan Jiuhua Electronic Equipment Factory, identified in a Xidian University recruitment listing as the People’s Liberation Army’s No. 6909 Factory, as a customer for two network-data-processing development contracts signed in 2019 and 2020. [5][11]
The contracts totaled RMB 45.8696 million. Integrity Tech reported RMB 39.8696 million in revenue from the customer in 2020, representing 13.67% of that year’s revenue. [5][7]
The contracts concerned a prototype system and an evaluation-and-scheduling subsystem. Their publicly disclosed descriptions do not reveal the precise operational purpose or establish any connection to Sparrow, MicroScan, or Flax Typhoon.
One provision is especially relevant to the economics of technical capability: the second contract included six years of maintenance services, from 2021 through 2026, at RMB 1 million per year.
The maintenance clause extended the supplier’s obligations beyond delivery. It gave the customer continuing access to external engineering capacity while making performance depend on Integrity Tech’s workforce and finances. The 2026 contract dispute would make that dependency visible.
This is a different arrangement from a customer employing the engineers directly. The contractor remains a separate company, responsible for meeting the service obligation while managing its own staff and cash. That distinction matters later: the dispute concerned whether maintenance was delivered under the contract, and the court’s provisional order reached company funds rather than the technical system itself.
4. Architecture of the Operation
4.1 The distinction between ownership and control
The Raptor Train botnet combined high-level management software, rented VPS infrastructure, command-and-control servers, and compromised third-party devices.
Sparrow operated at the management level. Its database contained information about infected devices, and its interface allowed authenticated users to issue operational commands.
The June 2024 Sparrow database examined by the FBI contained more than 1.2 million records of infected devices accumulated over time. Approximately 260,000 devices were recorded as actively infected at the relevant point in time. These figures describe different measures—historical records and active devices—and should not be treated as interchangeable. [1]
The legitimate owners purchased, powered, and connected the devices; the operators used malware and Sparrow to issue commands to them. A VPS subscription supplied lawful access to a server, while infection supplied unauthorized control over someone else’s equipment. Sparrow made these differently held resources operable as one botnet.
These layers also created distinct points of failure. Losing a rented server or domain could break a control route without removing the software or the people able to deploy it elsewhere. Losing an infected device reduced capacity but did not end the operation if replacement devices could be recruited. The size of the botnet therefore measured a maintained pool of access, not a stock of assets owned by the operator.
4.2 The operational chain
The 2024 and 2026 investigations describe several distinct operational functions.
| Function | Observed infrastructure or software | Critical authority |
|---|---|---|
| Reconnaissance | MicroScan, scanning tools, botnet resources | Selection of targets and scanning scope |
| Resource management | Sparrow, management servers, command-and-control (C2) infrastructure | Authentication, command dispatch, resource control |
| Access and persistence | Exploitation tools, FishHub-related activity, SoftEther VPN software | Access to victim systems and continuation of operations |
| Collection | File-search and email-collection tools | Selection and extraction of information |
| Data consumption | Storage servers and third-party email-viewing tools | Access to collected information |
| Infrastructure maintenance | VPS subscriptions, domain registrations, payment accounts | Provisioning, renewal, and operational continuity |
Figure 1 separates the documented botnet management and scanning connection from the later university and FishHub records. The investigations do not establish one continuous route through every named tool. [1][3][8]
These functions require different kinds of authority. Reconnaissance selects systems to examine; initial access would have to establish reach into a victim environment by a route the cited records do not identify; collection requires a further path to find and extract data. A remote connection alone does not establish which files or commands its user could access on a victim system. A person reading the resulting material need not be able to select targets, enter a victim system, or extract data. This functional sequence explains what a complete operation would require without claiming that the separate investigations document one such sequence from start to finish.
The joint advisory describes a web application through which third parties could view stolen email. It separately reports source-IP restrictions on access to some exfiltrated data. [3] The viewing application is a concrete example of the final boundary: someone could receive collected content without directly controlling reconnaissance or initial access. The records do not disclose those viewers’ identities, affiliations, payment arrangements, or who selected targets and authorized collection. Those missing decisions prevent the technical paths in Figure 1 from becoming a complete account of customer tasking.
4.3 What the kehu1036 records establish
The October 2026 seizure affidavit identified multiple VPS servers using names based on kehu1036.
The FBI investigator noted that kehu corresponds to the Chinese word 客户, meaning customer or client, and interpreted the numeric suffix as a customer identifier. [1]
The name is observable; its commercial meaning is the investigator’s inference. It does not identify a paying customer or billing arrangement. Authenticated Sparrow users likewise establish access to a management application, but not whether those accounts belonged to separate customers or one operational team. Together, the records show controlled access and task execution while leaving the relationship among developers, operators, customers, and government tasking authorities unresolved.
4.4 Why disrupting one component does not eliminate the capability
The FBI’s 2024 operation broke the connection between command servers and compromised devices. The 2026 warrants directed domain registrars and Verisign, the registry, to restrict and redirect the seized domains. [1] Neither intervention directly removed the source code, personnel, or alternative servers that could support replacement infrastructure.
Rebuilding that infrastructure would require engineers, hosting, domains, and money. The company’s financial disclosures reveal the scale of its legitimate resources; the investigative records reveal only fragments of the alleged operation’s costs.
5. The Economics of an Enterprise Attacker
5.1 The cost of producing capability
Integrity Tech’s legitimate financial statements offer an unusually detailed view of the cost structure of a company capable of producing advanced cybersecurity tools.
For 2025, its consolidated cash-flow statement reported the following figures:
| 2025 cash-flow item | RMB |
|---|---|
| Cash received from customers for goods and services | 315.57 million |
| Government grants received in cash | 16.48 million |
| Cash paid to suppliers for goods and services | 148.83 million |
| Cash paid to and on behalf of employees | 117.70 million |
| Net cash flow from operating activities | −2.25 million |
Source: 2025 Annual Report, consolidated cash-flow statement and note 78. [4]
These are different accounting categories: customer cash receipts are not annual revenue, and R&D expenditure may overlap with employee and supplier payments. The statement shows a company paying people and suppliers to maintain technical products, with government grants as another funding source. It does not allocate any of those payments to the alleged botnet service.
That distinction matters because a capability can be developed once and used repeatedly. Source code, testing systems, and expertise can survive an individual contract; the next user need not pay the full development cost. Operating servers and domains, owning the devices that carry traffic, and holding command authority remain separate costs and rights. Raptor Train placed many equipment and connectivity costs on the owners of compromised devices, a point the corporate cash-flow statement cannot capture.
5.2 The alleged sale of malicious capabilities
In September 2024, the FBI alleged that Integrity Tech was selling customers the ability to compromise and control consumer devices through an online application. [2]
If that assessment is correct, the product was access to managed infrastructure, not ownership of the devices or possession of the source code. Yet the public documents provide no service prices, invoices, customer-receipt ledger, or account trail for those alleged sales. The allegation describes a commercial model; the public record does not reconstruct its revenue.
The October 2026 affidavit documents a $139.50 payment on March 13, 2024, for five domain registrations, three of which were among the domains seized in 2026. The payment involved a financial-services account and a Hong Kong-issued credit card. Other related domains were registered separately in 2025, and renewals in February 2026 involved an Alipay account based in China. [1]
The affidavit also describes funds transferred from China to the United States to lease botnet-related VPS servers from a provider. [1] The record locates the payment transfer, not every leased server. These payments maintained infrastructure; they were not receipts from customers. They do not total the operation’s costs or identify its ultimate corporate funding source.
Three economic activities would have to be traced separately to reconstruct the business: producing tools and management software, paying for servers and domains to keep them running, and receiving payment, if any, for customer access. The developer, hosting payer, operator, and alleged customer could occupy different roles. The public records establish pieces of the first two activities and the FBI’s allegation of the third; they do not show how the corresponding accounts were connected.
5.3 Resources taken without ownership
Most devices at the bottom of Raptor Train belonged to unrelated people and organizations. Their owners paid for equipment, electricity, connectivity, and maintenance; the attackers obtained their use through compromise. A legitimate operator seeking hundreds of thousands of endpoints would have to purchase or lease equipment and network capacity. In a botnet, much of that underlying expense remains with the victims.
The botnet was not free to run. Vulnerable devices had to be found and infected; when access ended, operators had to infect new devices or regain control of earlier ones. Control software and supporting servers also required maintenance. Black Lotus Labs measured an average active lifetime of about 17 days for Tier 1 infections. [8] That short lifetime makes replenishment central: sustaining capacity required a continuing ability to renew and direct unauthorized access, not ownership of a stable fleet.
If customers bought access as the FBI alleged, they were buying the ability to command this changing pool of resources. The provider’s valuable asset would be its software and organizational capacity to maintain control, while the device owners involuntarily bore many physical operating costs. The public evidence does not permit a calculation of the savings, expenses, or profit margins. It does explain why the size of the compromised fleet alone cannot reveal the economics of the alleged service.
5.4 Where do the two financial systems meet?
Did legitimate customer revenue pay for intrusion infrastructure, or did alleged botnet-service receipts enter Integrity Tech’s accounts? The public record answers neither question. Its strongest bridge is technical: KRLab-related material recovered from Sparrow. Shared staff, code, and development systems could reduce the cost of a later operation, but no released record allocates those resources to Sparrow or traces a government contract into its expenses.
Reuse would be economically consequential even without a direct transfer between accounts. A company that already employs researchers and maintains tools could support later work without recording the full original development cost against each use. But that possibility does not establish that legitimate customers subsidized Sparrow. Proving it would require records that connect a particular team, project, or account to the operation, rather than general figures for the company as a whole.
| Relationship | What the public evidence establishes |
|---|---|
| Government customers paying Integrity Tech | Documented through contracts, procurement records, and corporate disclosures |
| Integrity Tech paying employees and suppliers | Documented at the corporate financial-reporting level |
| KRLab-related development assets appearing in Sparrow infrastructure | Described in FBI investigative materials |
| Payments for maliciously used infrastructure | Specific domain and VPS-related records described by investigators |
| Sale of compromised-device control to customers | Explicit FBI allegation |
| Revenue from those sales entering corporate accounts | Not publicly reconstructed |
| Government clients commissioning specific unauthorized intrusions | No complete contract-to-operation trail publicly established |
The table records distinct kinds of evidence, not one completed transaction path. A contract-to-operation order, internal cost allocation, or service invoice would be needed to establish how legitimate procurement and the alleged service were financed together, if they were.
5.5 The corporate form creates vulnerabilities of its own
The same corporate structure that retains technical capability also exposes a supplier to banks and contract enforcement. Integrity Tech faced two different constraints in 2025 and 2026.
On January 3, 2025, the U.S. Treasury designated the company under its cyber-related sanctions authorities. Integrity Tech publicly opposed the designation, characterizing the measures as unjustified and maintaining that it conducted legitimate business.
Its subsequent financial disclosures nevertheless recorded restrictions affecting bank accounts held by Hong Kong entities.
The company’s 2024 annual report disclosed that an account belonging to its Hong Kong subsidiary held approximately $2.208 million that had become frozen following the sanctions. Other Hong Kong-dollar accounts and unsettled checks were also affected. [9]
The company continued to report domestic business, but access to particular overseas assets was constrained. A separate dispute arose in April 2026.
Kunshan Jiuhua Electronic Equipment Factory, the military-related customer discussed earlier, filed a technology-contract dispute against Integrity Tech. The plaintiff alleged failures to fulfill post-delivery maintenance obligations and sought RMB 81.305 million in damages. [7]
Integrity Tech disputed the allegation, maintained that the systems had been accepted in 2020, and stated that RMB 4.993 million remained unpaid under the second contract.
At the plaintiff’s request, a Chinese court preserved RMB 81.3 million held in one of the company’s bank accounts.
This was a provisional asset-preservation measure, not a final determination that the company had breached the contracts or owed the damages claimed. The company’s August 2026 interim report continued to describe the litigation as pending. [10]
At the end of 2025, Integrity Tech reported approximately RMB 15.45 million in monetary funds restricted by account controls. By June 30, 2026, that figure had increased to approximately RMB 97.44 million.
The interim cash-flow notes also classified approximately RMB 82.47 million as bank-controlled funds within other operating cash payments. The company reported negative operating cash flow of RMB 116.12 million for the first half of 2026. [10]
The RMB 82.47 million bank-controlled amount is neither ordinary supplier expenditure nor a realized loss from the lawsuit; the notes do not fully reconcile each restricted balance to its legal cause. Negative operating cash flow alone does not establish insolvency: the company also reported approximately RMB 354.40 million in cash and cash equivalents at June 30, 2026.
The U.S. sanctions restricted access to overseas assets; the Chinese court’s provisional order restricted separate domestic funds. Neither record shows that the military-related contracts financed Flax Typhoon or that the dispute interrupted the alleged intrusions. It does show the supplier’s exposure: the same long-term contracts that sell specialized engineering capacity also create obligations whose enforcement can constrain company funds.
Those constraints operate through different authorities than a botnet takedown. Registrars can affect domain reachability; banks can restrict access to deposits; a customer can seek performance under a maintenance contract; a court can preserve funds while that dispute proceeds. None of these records shows that a particular employee or tool stopped operating as a result. They show why a company that can sustain a technical capability over years also depends on institutions outside the technical operation.
6. Conclusion
The Flax Typhoon investigations connect KRLab-labelled Sparrow material, a large compromised-device network, MicroScan reconnaissance, and later FishHub-related activity. U.S. authorities allege that Integrity Tech personnel developed, hosted, sold, and used intrusion capabilities. Corporate filings show the workforce, supplier relationships, government products, and maintenance contracts that a publicly listed company can sustain. The public record still does not identify the alleged botnet customers, trace their payments into corporate accounts, or link a named government contract to an unauthorized operation.
Raptor Train makes the economic distinction concrete. The device owners paid for equipment and connectivity. Operators bore the work of recruiting replacement devices and maintaining the system that directed them. If the FBI’s sales allegation is correct, a customer could buy command capability without owning either the devices or the management infrastructure. This would make continuing access to a managed, replenished pool more important than possession of any particular device. The missing transaction ledger prevents a calculation of who paid for that service or received its revenue.
The recovered management software and reported email-viewing interface also show why the person using a result need not be the person who acquired access or ran the tools. They support an analysis of separated roles, but the public records stop short of identifying who gave orders, which accounts represented paying customers, and whether the same arrangement governed every investigated activity.
The interventions also reached different parts of the organization. The FBI severed botnet control in 2024 and seized domains in 2026; U.S. sanctions restricted overseas assets in 2025; a Chinese court provisionally preserved funds in a separate contract dispute in 2026. These events do not form one proven chain of effects on the intrusions. They show that command channels, domain registrations, bank deposits, and maintenance obligations sit under different authorities.
A company can turn cyber capabilities into durable organizational assets by separating their production, operation, ownership, and use. But doing so also embeds those capabilities within systems of contracting, payment, infrastructure provision, and legal control.
Integrity Tech’s case makes those divisions visible. The financial question remains: who paid to sustain the alleged service, and who received its proceeds? A payment trail could identify customers, but records of tasking and account use would still be needed to establish who directed particular operations.
References
U.S. investigative and technical records
[1] U.S. Department of Justice. Justice Department and FBI Seize Vulnerability Scanning and Spear Phishing Tools Operated and Used by China-State Sponsored Hackers. October 8, 2026.
See also the 2026 FBI seizure affidavit, particularly pp. 7–16, for VPS account records, kehu1036, Sparrow, MicroScan, FishHub, domain registration, payments, and seizure procedures.
[2] U.S. Department of Justice. Court-Authorized Operation Disrupts Worldwide Botnet Used by People’s Republic of China State-Sponsored Hackers. September 18, 2024.
See also the associated 2024 search and seizure affidavit for the investigation of the botnet infrastructure. The independently readable 2026 affidavit cited under [1] documents the Sparrow source code and KRLab-labelled user guide.
[3] FBI, CISA, NSA, and international partner agencies. Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data. Joint Cybersecurity Advisory AA26-281A, October 8, 2026. Particularly pp. 4–11, concerning Integrity Tech’s alleged role, MicroScan, access methods, persistence, collection, and third-party email access.
Chinese corporate disclosures
[4] Integrity Technology Group. 2025 Annual Report. April 29, 2026. See pp. 7, 21–22, 30, 37, 56, 111, 175, 192, and 196 for operating results, technical organization, R&D, staffing, consolidated cash flow, grants, and restricted funds.
[5] Beijing Integrity Technology. IPO Prospectus. October 2022. See pp. 147, 194, 198, 206–208, and 310–312 for development projects, customers, suppliers, intellectual property, and cost structure.
[6] Beijing Integrity Technology. Responses to IPO Review Inquiries. December 2021. In particular, the descriptions of the case-lead tracking cyber range, task and resource management, public-security customers, and outstanding orders (including p. 116).
[7] Integrity Technology Group. Announcement Concerning Litigation. April 11, 2026, pp. 1–2. Development contracts with Kunshan Jiuhua Electronic Equipment Factory, maintenance terms, the plaintiff’s claims, the company’s response, and provisional asset preservation.
Independent technical analysis and financial constraints
[8] Black Lotus Labs / Lumen Technologies. Derailing the Raptor Train. September 18, 2024. Botnet campaigns, tiered architecture, device lifetimes, operational patterns, and infrastructure evolution.
[9] Integrity Technology Group. 2024 Annual Report. April 29, 2025, p. 233. Disclosures concerning restrictions on Hong Kong bank accounts following U.S. sanctions.
See also the U.S. Treasury’s January 3, 2025 sanctions action.
[10] Integrity Technology Group. 2026 Semiannual Report. August 29, 2026. See pp. 6, 68, 128, 144, and 147 for financial results, cash flow, restricted funds, cash equivalents, and the pending litigation. The interim statements are unaudited.
[11] Xidian University Employment Information Network. Recruitment notice for the People’s Liberation Army No. 6909 Factory. 2022. The page names Kunshan Jiuhua Electronic Equipment Factory as the listed employer.
Evidentiary scope
This article distinguishes corporate disclosures and independently observable technical records from the attribution judgments made by U.S. and partner governments.
Integrity Tech has opposed the U.S. sanctions designation. The company’s legitimate government contracts, R&D expenditure, and security products do not independently establish that particular unauthorized operations were commissioned or financed through those activities.
The FBI’s allegation of sales of compromised-device control capabilities is treated as an official investigative assessment. The public record does not provide a complete billing ledger, customer payment trail, or reconciliation between legitimate corporate accounts and alleged malicious services.
Corporate revenue, customer cash receipts, research expenditure, operational infrastructure payments, restricted bank funds, and unauthorized use of third-party equipment are therefore analyzed as distinct economic categories.