Government release

# Court-Authorized Operation Disrupts Worldwide Botnet Used by People's Republic of China State-Sponsored Hackers

United States Department of Justice, September 18, 2024. Seizure of botnet control, attribution to Integrity Technology Group, French assistance.

**Source type:** Government release

**Published:** September 18, 2024

**Research grade:** P1

**Used in entries:** 6

## Bibliographic record

**Publisher:** United States Department of Justice

**Published:** September 18, 2024

**Source type:** Government release

**Research grade:** Source grade P1

**Language:** English

**Official record:** Official publication

**Address:** No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

**What it supports:** Seizure of botnet control, attribution to Integrity Technology Group, French assistance

**Dataset id:** src\_doj\_raptor\_train\_2024

## Research notes

- URL not re-verified in this pass.

How this source is used

Cited 6 times across 4 record types.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 20, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Takedown records

1 citation

Cited on the takedown record itself.

-
[Raptor Train botnet disruption](https://takedownindex.org/takedowns/raptor-train-botnet-disruption)

State sponsored, September 2024

Primary source

### Organization roles

2 citations

Cited for an organization's recorded role in a takedown.

-
[Federal Bureau of Investigation](https://takedownindex.org/takedowns/raptor-train-botnet-disruption)

Operational lead, Raptor Train botnet disruption

Primary source
-
[United States Attorney's Office for the Western District of Pennsylvania](https://takedownindex.org/takedowns/raptor-train-botnet-disruption)

Prosecuting, Raptor Train botnet disruption

Primary source

### Infrastructure

2 citations

Cited for infrastructure recorded as acted on.

-
[more than 200,000 malware installations](https://takedownindex.org/takedowns/raptor-train-botnet-disruption)

Malware installations remediated, Raptor Train botnet disruption

Primary source
-
[Command and control server](https://takedownindex.org/takedowns/raptor-train-botnet-disruption)

Command and control server taken over, Raptor Train botnet disruption

Primary source

### Excluded candidates

1 citation

Cited for a candidate event assessed and left out of the index.

-
OFAC designation of Integrity Technology Group

Sanctions-only action following the Raptor Train disruption.

Primary source

[All sources](https://takedownindex.org/sources)