Ten government cybersecurity agencies across seven countries put their names to the same finding on 8 October 2026.[1] On its own, that would not be unusual. Joint advisories naming a state-linked hacking cluster are a fixture of the calendar now. What made this one different sat in a single sentence, easy to read past on a first pass. The advisory did more than name a tracked activity cluster: it named a company.
Integrity Technology Group trades on the Shanghai Stock Exchange under its own ticker. It publishes a market capitalisation of roughly US$318 million and revenue of roughly US$56 million. By its own account, it sells network security products, including penetration-testing tooling, "although apparently exclusively to Chinese customers."[2] The ten agencies say its tooling and its infrastructure are also what a tracked Chinese state-linked hacking operation runs on.[1] A vendor did this. A state is the customer.
Every supplier due diligence checklist your organisation already runs, financial stability, certification status, sanctions screening, sub-processor disclosure, is built to answer questions about a supplier's own conduct and solvency. None of them asks whether a supplier's own commercial product line might itself be offensive tooling. That question assumes a company could sell to a hostile intelligence service as one line of business among others, in public, with a stock ticker. Most boards have never had to ask it. After 8 October, the question exists whether anyone asks it or not.
The Vendor With a Stock Ticker
The advisory, AA26-281A, carries ten named co-sealing agencies. The FBI leads, followed by the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the United Kingdom's National Cyber Security Centre, Australia's Cyber Security Centre, Canada's Centre for Cyber Security, two Japanese bodies, New Zealand's own National Cyber Security Centre, and Spain's national intelligence centre.[1] It describes Integrity Technology Group as "a China-based for-profit company with links to the Chinese government" that develops or acquires tools, hosts infrastructure, and compromises networks on behalf of actors tracked under three separate cluster names.[1]
The tradecraft itself is not spectacular. A custom platform named MicroScan runs more than 1,300 penetration-testing scripts against known flaws in widely used server software, OpenSSL, Oracle WebLogic, WordPress, Jenkins and Apache Struts among them.[3] Initial access comes from credential harvesting and password spraying against mail servers. Persistence comes from a legitimate remote-access client, renamed to mimic ordinary Windows processes so it does not stand out in a log.[3] None of it requires a novel exploit. All of it requires a target that has not patched a known flaw or noticed an unfamiliar process name, which describes most networks on most days.
What follows the advisory is a patchwork. The United States added Integrity Technology Group to its sanctions list in January 2025, following the 2024 botnet disclosure.[4] The United Kingdom designated the company in December 2025, citing the same botnet.[5] The European Union added its own designation in March 2026, citing a separate campaign against six member states.[6] Three jurisdictions, three separate actions, each one a response to a specific, already-disclosed campaign against that jurisdiction. None of the three is a forward-looking screen of the company's declared product line or its customer base. Each arrived only after the fact, and only on behalf of the state that had been targeted.
New Zealand is not among the three. It has not sanctioned Integrity Technology Group, and its only sanctions statute is specific to Russia's invasion of Ukraine. A board that waits for a New Zealand sanctions designation as its signal that a vendor is a problem is waiting for something that may not come. Under the current legal settings, that signal may never arrive, whatever the underlying attribution turns out to be.
The Question No Framework Asks
A board's assurance process typically runs through four checks: is the vendor financially stable, is it certified against a recognised standard, does it appear on a sanctions list, and has it disclosed its own sub-processors. Integrity Technology Group clears three of those four without difficulty. It is financially stable and publicly listed, with disclosed revenue. It was not on any sanctions list before the first disclosure that triggered one. Nothing in a standard certification audit asks a vendor what else its product line includes, or who its other customers are.
The gap sits in the question. The fiduciary risk formula this series has used before, cost of remediation multiplied by probability of breach, plus potential loss, is built to price a known exposure. It assumes the exposure has already been named. The harder problem here sits one step earlier: nobody had named Integrity Technology Group as an exposure until ten governments did it together, in public, on the same day. The cost of remediation that actually matters is writing one new question into a procurement form before any contract exists: what else does this vendor's own commercial tooling include, and who else buys it.
The book framework closest to that question, the Audit of Intent, does not reach it as written. It is a use-time, behavioural control over an account that already exists: it asks whether this session's access pattern matches what this user normally does, after credentials have already been presented. It has nothing in its literal mechanism that reaches a pre-contract question about a vendor's other customers. Borrowing its name here means asking about intent before the account exists, not only after. It does not mean the tool as built already answers a different problem.
What New Zealand Can and Cannot Check
New Zealand has exactly one codified instrument that reaches toward this territory. Since August 2023, government procurement rules have required agencies to assess foreign-state ownership or control of a supplier: more than a quarter of its securities held by that state, control of its governing body, or a legal right to direct its activities toward that state's strategic objectives. They must also assess whether sub-suppliers in the chain have access to sensitive assets.[7] That is a real, current, national-security-specific screen. It is also government-procurement-only; it does not bind a single private-sector board. And even it does not ask whether a supplier's own commercial product line includes offensive tooling, or whether that supplier's other customers include an intelligence service. It is the closest instrument New Zealand has.
Thirty-Eight Companies, One Unanswered Claim
Four days after the advisory, an extortion group calling itself n0n listed thirty-eight port, shipping and logistics organisations across eighteen countries on its leak site in a single batch. It demanded ransoms of between US$2.4 million and US$14 million, with a publication deadline of 13:27 UTC on 19 October 2026.[11] As of this writing, not one of the thirty-eight has confirmed it was compromised. The firm tracking the listings says plainly that the claim should be treated as unverified.[11]
This is the same assurance failure as the vendor problem above, arriving from a different angle in the same week. Thirty-eight organisations across eighteen countries cannot assess their own exposure to a claim that none of them has confirmed. A board asked this week whether its shipping partner is affected has no more reliable an answer than one asked last month. That earlier board was asking whether its software vendor's other customers include a state intelligence service. In both cases the honest answer is: nobody has built a way to find out before it matters.
The Question Before the Contract
The practical fix is one additional question on the procurement form, asked before a contract exists rather than after an advisory names a problem. It is cheaper than a new scanning tool and cheaper than a bigger threat-intelligence budget line. Who else buys from this vendor. Does this vendor's declared product line include anything that a government could use the same way a state actor is alleged to have used Integrity Technology Group's. Those two questions cost nothing to add and nothing to answer honestly if the answer is no.
A board that wants to go further than a form has three concrete steps available this quarter. First, map which vendors in the current supplier list sell cybersecurity tooling, access management or network infrastructure, rather than only the vendors flagged as "critical." Second, add the product-line and customer-base question to every renewal and every new contract in that category, not retrospectively to every existing one. Third, treat a clean sanctions-list result as the floor of the check. Sanctions arrive after disclosure, not before. A vendor can be entirely clean on every list today and still be the subject of next year's advisory.
None of this requires New Zealand to pass a new law, and none of it waits on one. The gap this advisory exposes sits inside what a board already controls.
A vendor's tooling is itself answerable more often than boards assume. The open-source community's public vulnerability catalogue and coordinated disclosure process gave Integrity Technology Group's own scanning platform its target list: OpenSSL, Jenkins, Apache Struts and WordPress, each with a dated, public history of disclosed flaws, patched by maintainers nobody has to trust blindly because the work is checkable. That transparency cuts both ways. It lets a defending organisation know, by CVE number and patch date, exactly what was knowable and when. A vendor's own commercial tooling rarely offers that. The comparison worth running this quarter is not whether your software is open source, but whether you can check it the way you can check OpenSSL. For most procurement categories, the answer is no. That is itself worth recording.
What this means for allied supply-chain assurance follows the same shape at a different altitude. AA26-281A's own co-sealing list, ten agencies across seven countries, is wider than any single five-nation alliance structure and looser than a treaty. It is an assembly built around a shared finding, not a shared obligation. That is close to the ambition behind AUKUS Pillar 2's advanced-capability and critical-technology work, where allied states are meant to coordinate on evidence before they coordinate on policy, supply-chain risk included. The sanctions pattern that followed this advisory's predecessor shows the same structure again: reactive, jurisdiction-specific, arriving only once a campaign against that jurisdiction has already been disclosed. It never arrives as a forward screen of a company's declared business. A board's own procurement question carries no such limitation. It can run before any of the ten agencies has anything further to report.
The honest summary is smaller than the headline suggests. A government did not catch a hidden attacker this month. Ten of them named a company that had been operating in public the entire time, with a stock ticker, an annual report, and a stated business. The attacker was never hidden.
What would it take for your organisation to find out, this quarter, whether any vendor on your current supplier list could answer the question this advisory just forced into the open?
If your board wants an independent AI and cyber risk briefing, or a review of what your vendor's assurance actually verified, message me and I will send the scope and the fixed fee.
The views expressed in this article are entirely my own, informed by more than 30 years of professional experience in architecture, security, and technology leadership in New Zealand. I write as director of Te Pono Limited; the views are personal and do not represent the position of any client, any government agency, or the New Zealand government. My commentary on legislation and policy is analytical, drawing on publicly available sources and my professional expertise in architecture, security, and AI governance, and it is politically neutral.
Andreas Hamberger is a New Zealand leader in Architecture & Security and Associate Member of the Institute of Directors. The Hamberger Report: Cyber Guide for New Zealand Boards is the third book in The Hamberger Report series, providing board members and senior leaders with practical cyber resilience governance guidance. Through Te Pono he provides independent AI and cyber risk briefings and vendor assurance reviews to boards; contact andreas@thehambergerreport.com for the scope and fixed fee.
This article was produced with AI assistance under my direction. Research, drafting and images pass through a pipeline I built and govern: automated gates for source verification, forbidden language and political neutrality, and my own review before anything is published. The tools include Claude, Gemini and Openart. The frameworks, arguments and editorial judgements are mine and are the same discipline I apply to the AI systems I audit for clients. AI accelerated the work; the thinking, and the responsibility for it, are mine.
[1] CISA, FBI, NSA, NCSC-UK, Australian Cyber Security Centre, Canadian Centre for Cyber Security, Japan NPA/NCSO, NCSC New Zealand, and Centro Nacional de Inteligencia (Spain). "Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data" (Advisory AA26-281A). 8 October 2026. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a
[2] The Record. "A Chinese public company is accused of powering the Flax Typhoon botnet." 2026. https://therecord.media/china-public-company-integrity-tech-accused-flax-typhoon-botnet-fbi
[3] Picus Security. "CISA AA26-281A: How Chinese Government-Linked Actors Steal Sensitive Data." 2026. https://www.picussecurity.com/resource/blog/cisa-aa26-281a-how-chinese-government-linked-actors-steal-sensitive-data
[4] United States Department of the Treasury, Office of Foreign Assets Control. Recent Actions, 3 January 2025. https://ofac.treasury.gov/recent-actions/20250103
[5] United Kingdom Office of Financial Sanctions Implementation. UK Sanctions List, designation CYB0113. 9 December 2025. https://search-uk-sanctions-list.service.gov.uk/designations/CYB0113/Entity
[6] Council of the European Union. "Cyber-attacks against the EU and its Member States: Council sanctions three entities and two individuals." 16 March 2026. https://www.consilium.europa.eu/en/press/press-releases/2026/03/16/cyber-attacks-against-the-eu-and-its-member-states-council-sanctions-three-entities-and-two-individuals/
[7] New Zealand Government Procurement. "Managing national security risks." Guidance, in effect since 14 August 2023. https://www.procurement.govt.nz/government-procurement-framework/government-procurement-rules/approaching-the-market/managing-national-security-risks/
[8] Insurance Business Magazine Australia. "Australian and NZ firms' OT cyber losses average $2m per incident, Claroty finds." 2026. https://www.insurancebusinessmag.com/au/news/cyber/australian-and-nz-firms-ot-cyber-losses-average-2m-per-incident-claroty-finds-592978.aspx
[9] Claroty. "New research finds 58% of cyber-physical system operators say a cyberattack has impacted operational environments in the past year." Press release, 2026. https://claroty.com/press-releases/new-research-finds-58-of-cyber-physical-system-operators-say-a-cyberattack-has-impacted-operational-environments-in-the-past-year
[10] National Cyber Security Centre, New Zealand. "Cyber Threat Report 2026: By the Numbers." 18 September 2026. https://www.ncsc.govt.nz/insights-and-research/cyber-threat-reports/cyber-threat-report-2026/by-the-numbers-202526/
[11] The Loadstar. "Cyber crime group hits 38 shipping and port groups with date leak threat." 2026. https://theloadstar.com/cyber-crime-group-hits-38-shipping-and-port-groups-with-date-leak-threat/