Flax Typhoon Used Raptor Train IoT Botnet to Mask Critical Infrastructure Intrusions

U.S. authorities and private-sector researchers said the China-linked threat actor Flax Typhoon operated a sprawling IoT botnet known as Raptor Train to conceal intrusions into critical infrastructure networks. Black Lotus Labs said the botnet had been active since 2020, at one point exceeding 60,000 live nodes and compromising more than 200,000 routers, NAS devices, IP cameras, and other internet-exposed systems. The operation used a multi-tier architecture and a custom Mirai-derived implant called Nosedive, which enabled remote command execution, file transfer, and retained DDoS capability while using in-memory execution and anti-forensics techniques. Researchers linked the activity to targeting in the United States and Taiwan across government, military, telecommunications, higher education, defense industrial base, and IT sectors, alongside scanning and likely exploitation attempts against Atlassian Confluence and Ivanti Connect Secure appliances.

The FBI and Department of Justice said they disrupted the botnet in a court-authorized operation that removed malware from infected routers, and officials later said the action effectively dismantled infrastructure used by Chinese operators to hide follow-on hacking. Subsequent reporting said the botnet exploited dozens of vulnerabilities across edge and IoT products, with VulnCheck identifying 66 actively targeted CVEs tied to the campaign, far more than were listed in CISA’s Known Exploited Vulnerabilities catalog. Additional reporting also pointed to corporate links around Integrity Technology, described as connected to Flax Typhoon and tied through competitive, partner, and client relationships to i-SOON, adding to the picture of a broader Chinese intrusion ecosystem supporting espionage and potential disruptive operations.