Raptor Train
Raptor Train is a large China-linked botnet active since at least May 2020 and disrupted by the FBI and Black Lotus Labs in 2024. It infected more than 200,000 devices worldwide over its lifetime, with reporting citing more than 260,000 compromised networking and IoT devices and a peak of over 60,000 active devices in June 2023. The botnet targeted critical infrastructure and strategic sectors including military, government, telecommunications, higher education, defense industrial base, and IT organizations, with primary targeting observed against entities in the United States and Taiwan and at least one government target in Kazakhstan.
The botnet infected SOHO routers, modems, IP cameras, NVRs, DVRs, firewalls, and NAS devices from numerous vendors including ActionTec, ASUS, TP-LINK, DrayTek, Tenda, Ruijie, Zyxel, Ruckus, Hikvision, D-LINK, AXIS, Panasonic, Shenzhen TVT, QNAP, Fujitsu, and Synology. Researchers reported exploitation of more than 20 device types using both zero-day and known vulnerabilities. The primary payload was a Mirai variant called Nosedive. Although Nosedive is associated with DDoS capability, researchers did not observe Raptor Train conducting DDoS attacks in the wild.
Black Lotus Labs described Raptor Train as a sophisticated multi-tiered botnet with enterprise-grade control infrastructure. Its architecture included Tier 1 bots on infected edge and IoT devices, Tier 2 nodes for second-stage delivery and command-and-control, and Tier 3 management systems referred to by the operators as Sparrow nodes. The Sparrow nodes were manually operated over SSH or TLS and included a web interface, backend services, and tooling to generate payloads and exploits. Tier 1 infections were typically short-lived, averaging about 17 days because the Nosedive payload lacked persistence, while Tier 2 and Tier 3 nodes persisted longer. The botnet’s command-and-control footprint expanded significantly over time, growing from a handful of nodes to more than 60 in 2024.
Observed activity included scanning of U.S. military and government networks, targeting of IT providers and defense industrial base organizations, and exploitation attempts against Atlassian Confluence servers and Ivanti Connect Secure appliances, likely including CVE-2024-21887. In the Canary campaign beginning in May 2023, operators focused on ActionTec PK5000 modems, Hikvision IP cameras, Shenzhen TVT NVRs, and ASUS RT and GT routers; one Tier 2 server infected at least 16,000 devices over nearly two months. Another campaign, Oriole, ran from June 2023 until September 2024 and used infrastructure including the domain w8510[.]com.
The FBI linked Raptor Train with high confidence to the Chinese state-sponsored Flax Typhoon threat group and stated that the botnet was controlled through infrastructure operated by Integrity Technology Group using China Unicom Beijing Province Network IP addresses. Reporting also noted Chinese-language code comments and interface text, and that Tier 3 to Tier 2 SSH connections occurred almost exclusively during China’s normal workweek hours. During disruption efforts, the FBI conducted court-authorized operations to seize infrastructure and remove malware from infected devices, while Black Lotus Labs null-routed traffic to known management, command-and-control, payload, and exploitation infrastructure. The FBI also reported that operators attempted to migrate infected devices to new servers during the takedown.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The FBI and cybersecurity researchers have disrupted a massive Chinese botnet called “Raptor Train” that infected over 260,000 networking devices to target critical infrastructure in the US and in other countries.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The FBI and cybersecurity researchers have disrupted a massive Chinese botnet called “Raptor Train” that infected over 260,000 networking devices to target critical infrastructure in the US and in other countries.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
4 techniquesSince May 2020, over 200,000 devices, including SOHO routers, NVR/DVR devices, NAS servers, and IP cameras, have been compromised and added to the Raptor Train botnet.
For example, China's Integrity Technology Group controlled and managed the so-called Raptor Train network, which in 2024 infected more than 200,000 devices worldwide, including small office home office (SOHO) routers, internet-connected web cameras and video recorders, plus firewalls and network-attached storage (NAS) devices.
The botnet malware infected numerous types of consumer devices, including small-office/home-office (SOHO) routers, internet protocol (IP) cameras, digital video recorders (DVRs), and network-attached storage (NAS) devices. The malware connected these thousands of infected devices into a botnet, controlled by Integrity Technology Group...
T1584.008 Compromise Infrastructure: Network Devices — Devices are compromised and added to botnets
Command and Control
3 techniquesThe malware connected these thousands of infected devices into a botnet, controlled by Integrity Technology Group, which was used to conduct malicious cyber activity disguised as routine internet traffic from the infected consumer devices.
A majority of China-linked threat actors are using compromised routers and IoT devices worldwide, turning this gear into proxy networks to carry out further intrusions, steal sensitive data, and disrupt victim organizations’ operations.
...used to conduct malicious cyber activity disguised as routine internet traffic from the infected consumer devices... For the second time this year, we have disrupted a botnet used by PRC proxies to conceal their efforts to hack into networks in the U.S. and around the world...
IOCs tracked for this family
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A large covert network/botnet of compromised routers, cameras, recorders, firewalls, and NAS devices used to provide proxy infrastructure for China-linked intrusion activity.
Long-running botnet campaign built over several years, with large numbers of compromised devices and an expanding multi-tier C2 infrastructure.
A botnet referenced as one of several past residential proxy or router-focused botnets taken down by law enforcement or governments.
A botnet attributed in the article to China-nexus activity that infected more than 200,000 devices worldwide in 2024.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.