On 8 October 2026, 10 agencies from across seven countries, from the FBI in the US to the UK’s National Cyber Security Centre (NCSC) to Spain’s Centro Nacional de Inteligencia (CNI), put their names to a 58-page advisory on Integrity Technology Group, a for-profit Chinese company with government links whose staff build and sell tools, acquire and host infrastructure and compromise networks directly.
We have met Integrity Tech before. It was named in September 2024 as the operator of the botnet behind Flax Typhoon, and the UK government sanctioned it in December 2025. The new advisory describes a scanning platform, MicroScan, with more than 1,300 vulnerability-checking scripts, in use since 2017, and infrastructure still active in June 2025, nine months after that first exposure.
So what does exposure actually buy us? We find the compromised systems, share the indicators and start evicting the attacker. All of that matters of course, but the intelligence requirement that sent the attacker there in the first place survives it all. If a government wants access to your networks (for telecoms, government and critical infrastructure, plenty do), losing one operation is simply a cost of doing business.
The actions of Salt Typhoon make the same point at a larger scale. Its intrusions reached as far as the systems US telecoms providers are legally required to maintain for court-authorised surveillance, and in August 2025 a multinational advisory tied the activity to three China-based companies supplying cyber products and services to Chinese intelligence and military organisations. In my view, Beijing’s interest in what sits inside those networks outlived the headlines.
I am wary of treating every newly exposed campaign as proof that cyber warfare has changed, because espionage and pre-positioning are as old as statecraft. What has changed is how much of the machinery we can now see. In March 2025 the US Department of Justice (DoJ) charged individuals linked to another contractor, i-Soon, alleging that the company worked with at least 43 bureaus of the Ministry of State Security and the Ministry of Public Security, sometimes hacking to order and sometimes hacking on spec and selling the results afterwards. Those remain allegations. The state sets the strategic requirements, while contractors can provide the capabilities and operational capacity to pursue them, as specialist suppliers to intelligence services always have, and what that model buys is resilience. Of the eight vulnerabilities the Integrity Tech advisory lists as successfully exploited, the oldest is a 2014 flaw in Bash and the newest dates from 2023. A contractor working at that scale can exploit cheap ways back in, and an unpatched edge device is about as cheap as it gets.
Our research at Rapid7 shows how much effort is still going into staying inside telecoms networks quietly. BPFDoor, a backdoor associated with China-nexus activity, abuses Berkeley Packet Filter functionality on Linux to inspect incoming traffic for a specially crafted trigger packet, with no conventional listening service for a defender to find. Until that packet arrives, it simply waits. A follow-up study of nearly 300 samples identified seven previously undocumented variants, several built to make activation and communication look like ordinary traffic. The most recent work found implants tailored to the specific telecoms and network-edge appliances they lived on, some impersonating the products’ own processes and others hiding in SMTP traffic on mail-security appliances (where SMTP is the whole point of the box), with a second implant, AVERAT, relaying communications through compromised third-party devices.
Nothing in that research ties BPFDoor operationally to Salt Typhoon, still less shows it replacing access lost after the disclosures. We don’t need it to. Salt Typhoon showed how useful a victim’s own capabilities are to an intruder; BPFDoor shows attackers studying the environment closely enough for their backdoor to pass as part of it. The contest for persistent access to these networks carries on after any one campaign is burned, and the tooling continues to evolve.
In April the NCSC, with industry and 15 international partners, published guidance on the covert networks China-nexus actors build from compromised routers, storage devices and other internet-connected kit, citing evidence that those networks are created and maintained by Chinese information security companies. They can be refreshed or replaced after defensive action. Even the attack infrastructure is cheap to rebuild, because it is made of other people’s equipment. That guidance was written with industry through the NCSC’s Cyber League, and I think that is where the private sector earns its seat. Governments can name and sanction, but it is vendors, operators, and responders who see the implants and the traffic.
Remediation still matters, because every implant removed and every relay denied raises the cost of dwelling. But the cheaper win is closing an exposure before anyone uses it, and if you run telecoms or other strategically important infrastructure, hunting for the last campaign’s indicators will mostly find the last campaign. Start where your visibility is weakest, which for most operators means network appliances, embedded Linux and management interfaces that have never seen an endpoint agent. Hunt for behaviour rather than known-bad files; the BPFDoor research gives you concrete starting points, from packet filters attached to raw sockets to masqueraded processes and appliances talking to places they have no business talking to.
And if you sit on a board, a clean bill of health after remediation means only that you found what you were looking for. On 13 October Ken McCallum, MI5’s director general, said the service’s state-threat caseload has quadrupled in a decade and that it now spends more resource countering state threats than it did during the Cold War. The geopolitical reasons someone wanted in are exactly where they were before your incident response started. So the useful question for the board is this: which of your exposures would an adversary who has been here before reach for first?
The newest implant chain we have found at Rapid7 deletes its own files ten seconds after launch and keeps running regardless, because the people who wrote it fully expect to be looked for.
