Loading malware…
Raptor Train is a China-linked botnet associated with the state-sponsored threat actor Flax Typhoon and developed and managed by Integrity Technology Group. Active from at least May 2020 until its disruption in September 2024, it recruited compromised small-office/home-office routers, modems, firewalls, IP cameras, video recorders, and network-attached storage devices worldwide. The FBI identified more than 260,000 actively infected devices in June 2024, including approximately 126,000 in the United States. The network supported cyberespionage by relaying malicious traffic through compromised devices to conceal operators’ locations and infrastructure.
Its principal payload, Nosedive, is a Mirai variant deployed through exploitation of known and zero-day vulnerabilities across more than 20 device types. Raptor Train used a three-tier architecture separating infected devices, exploitation and payload-delivery infrastructure, and management systems. Operators controlled the network through an application called Sparrow, which provided web-based management and supporting payload-generation and exploitation tooling. Nosedive lacked persistence, and infected first-tier devices typically remained enrolled for approximately 17 days. The payload included distributed denial-of-service capabilities, although researchers did not observe routine DDoS deployment during their tracking; the FBI reported a DDoS attack against its infrastructure during the disruption operation.
Raptor Train supported reconnaissance, vulnerability scanning, and exploitation attempts against strategic targets, particularly in the United States and Taiwan. Targeted sectors included government, military, telecommunications, higher education, information technology, critical infrastructure, and the defense industrial base. Its infrastructure supported MicroScan reconnaissance, and researchers observed scanning of U.S. government and military networks and exploitation attempts against Atlassian Confluence and Ivanti Connect Secure systems. In September 2024, a court-authorized FBI operation took control of botnet infrastructure and removed malware from infected devices, while Lumen’s Black Lotus Labs blocked traffic to known operational infrastructure.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Претходно, групата беше поврзана со ботнетот Raptor Train, составен од илјадници компромитирани уреди што се користат во мали канцеларии и домашни мрежи (SOHO), како и IoT-уреди.
Flax Typhoon was previously attributed to a botnet called Raptor Train that comprised thousands of compromised small office/home office (SOHO) and IoT devices.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Since May 2020, over 200,000 devices, including SOHO routers, NVR/DVR devices, NAS servers, and IP cameras, have been compromised and added to the Raptor Train botnet.
For example, China's Integrity Technology Group controlled and managed the so-called Raptor Train network, which in 2024 infected more than 200,000 devices worldwide, including small office home office (SOHO) routers, internet-connected web cameras and video recorders, plus firewalls and network-attached storage (NAS) devices.
The Raptor Train botnet, disrupted by the United States, offers a clear illustration of this contractor model. It was attributed to Chengdu-based Integrity Technology Group, found responsible for developing the botnet and therefore held partly accountable for intrusion activities attributed to Flax Typhoon.
T1584.008 Compromise Infrastructure: Network Devices — Devices are compromised and added to botnets
Telecom equipment... can obviously be compromised, at least from the operator’s side, for example, during maintenance.
The connection points of small remote industrial infrastructure facilities typically use inexpensive network equipment... such devices can be manipulated ... as an entry point into the IT or OT network.
The malware connected these thousands of infected devices into a botnet, controlled by Integrity Technology Group, which was used to conduct malicious cyber activity disguised as routine internet traffic from the infected consumer devices.
A majority of China-linked threat actors are using compromised routers and IoT devices worldwide, turning this gear into proxy networks to carry out further intrusions, steal sensitive data, and disrupt victim organizations’ operations.
...used to conduct malicious cyber activity disguised as routine internet traffic from the infected consumer devices... For the second time this year, we have disrupted a botnet used by PRC proxies to conceal their efforts to hack into networks in the U.S. and around the world...
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.