The event
On 8 October, ten cyber and intelligence agencies from seven countries published a joint advisory. The signatories include the FBI, NSA and CISA, the UK’s NCSC, and agencies from Australia, Canada, Japan, New Zealand and Spain (CISA).
Its subject is not a hacking unit. It is Integrity Technology Group, a China-based for-profit company that the agencies say has links to the Chinese government. According to the advisory, it builds and sells cyber tools, hosts attack infrastructure and breaks into networks itself (joint advisory).
10
agencies from 7 countries signed the advisory
2014
year the oldest flaw it exploited was disclosed
1,300+
testing scripts in one scanning application, in use since 2017
What everyone is saying
The consensus read is familiar. Another Chinese campaign, another appendix of indicators, another round of patch and hunt. Security teams will load the indicators into their tools and move on.
The contrarian read
That misses the point. Read the advisory’s background section, not its appendix. The agencies describe a company that acquires tools for use and for sale, acquires and hosts infrastructure, and compromises networks itself. The operators it enables keep a web application that lets third parties browse stolen email. That is not a military unit. It is a supplier with a product line and customers. In some cases, the stolen data could only be opened from IP addresses in Xiamen.
Two consequences follow. First, deterrence stops working the way ministries assume. You can signal to a state. A contractor’s incentive is revenue, and it may serve several clients at once. The advisory itself warns that the operators it enables may also run activity unconnected to the company. The agencies tie the tradecraft to groups the industry tracks as Flax Typhoon and Ethereal Panda, among others. Attribution gets blurrier by design.
Second, look at what this supplier actually used. Its list of successfully exploited flaws includes vulnerabilities disclosed in 2014 and 2015. Much of its scanning kit is open-source tools of the kind typically found on GitHub. Persistence relies on a legitimate VPN client that endpoint tools are less likely to flag.
Industrialised offence does not need zero-days. It needs volume, and targets that never closed the old doors.
The attacker has industrialised. Most defenders still work like craftsmen, fixing whatever the last audit found.
The geopolitical frame
For middle powers, this is the part that matters. Seven governments signed the advisory. Many victims sit outside that group: government, police, health and religious institutions in Southeast Asia, plus organisations in Africa and North America.
When offence becomes a commercial service, any state that can pay can rent capability it never built. Any state that cannot defend at scale becomes inventory. Expect more advisories that name companies rather than governments. Naming a company is a cheaper diplomatic act than naming a state, and that choice is itself a signal.
For governments, for boards
For governments
Your threat model must include contractors, not only states. Ask how many of your exposed systems would appear on a commercial attack dashboard this week.
For boards
The adversary has a sales target. Being the easiest target in your sector is now a measurable commercial risk, not bad luck.
Monday morning
- Map what answers from the internet. Scan everything you own from the outside and close what has no business reason to be exposed.
- Retire the decade-old debt. Patch or remove systems carrying flaws more than five years old. They are the cheapest entry on any attacker’s price list.
- Watch your legitimate tools. Alert on new VPN clients, remote-access software and mailbox access through APIs that nobody approved.
About the desk
Elias Marek is the pen name of Beyond’s threat-analysis desk: practitioners with two decades across offensive security, government, finance and critical infrastructure. The Contrarian Desk is opinion. Where it names a state, it says who named it first.
All columns