International coalition disables tools of Integrity Tech linked to Flax Typhoon

What happened and what to do

According to the report by The Record, published on October 8, 2026, the United States and other nations took down digital tools and infrastructure of Integrity Tech, based in Beijing. According to the report, these tools enabled widespread vulnerability scanning and, in some cases, intrusions, as part of the campaign attributed to the group Flax Typhoon.

For companies, the case shows that exposure to automated scans of internet-facing systems is constant. A practical response starts with an inventory of the organization's public services, followed by continuous monitoring of exposed ports, certificates and software versions, with alerts when something changes. It also helps to log and correlate access attempts in centralized logs, to distinguish scanning from intrusion patterns and prioritize fixes.

How the consultancy can help

Diagnosis of your organization's exposed surface against automated scanning, covering public services, versions and critical configurations. Then design and deployment of a continuous monitoring pipeline with alerts and a prioritization dashboard, operated in the client's environment.

Next step

If your company wants to understand its exposure to automated scans and intrusions, send a brief description of your environment and internet-facing systems. You will receive a proposal with a defined scope for diagnosis and implementation.