Skip to main content
Back to the takedown index

Raptor Train botnet disruption

September 2024, State sponsored
Led by Federal Bureau of Investigation

Verified core entry, last reviewed August 21, 2026

What was taken down?

Control of the botnet infrastructure seized; malware disabled on compromised devices; operators' attempt to migrate the botnet was countered.[1][2]

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not applicable

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

Court-authorized DOJ and FBI operation seizing control of a botnet of consumer devices operated by the PRC-linked company Integrity Technology Group, tracked as Flax Typhoon, with French assistance.[1][2]

Announced September 18, 2024.

Date
September 1 to September 18, 2024
Target
Raptor Train, compromised iot device network
Activity
State sponsored, Malware and botnets
Operational lead
FBI
Partners
USAO-WDPA, Black Lotus Labs[1][2]
Jurisdiction
United States and France
Outcome
Control of the botnet infrastructure seized; malware disabled on compromised devices; operators' attempt to migrate the botnet was countered.
Status
Completed
Legal mechanism
Court-authorized seizure and Rule 41 process, Western District of Pennsylvania
Group accounted for
Not applicable

Infrastructure

200,000 malware installations remediated. Command and control servers taken over, with no count in the record.

more than 200,000
malware installations remediated
Identifier Recorded as Status Notes
Not published more than 200,000 malware installations Remediated More than 200,000 consumer devices including routers, IP cameras, DVRs, and network attached storage.[1][2]
Not published Command and control server Taken over Control of the botnet infrastructure seized; an attempted migration by the operators was countered.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

State-sponsored infrastructure disruption.

State-linked contractor company rather than a finite criminal operator group.

See the organizations and roles behind this action

Integrity Technology Group later sanctioned by OFAC in a separate action.[1][2]

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    Court-Authorized Operation Disrupts Worldwide Botnet Used by People's Republic of China State-Sponsored Hackers

    United States Department of Justice, September 18, 2024, Source grade P1

    Seizure of botnet control, attribution to Integrity Technology Group, French assistance

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Additional reporting and technical analysis

  1. [2]
    Black Lotus Labs research on the Raptor Train botnet

    Lumen Technologies Black Lotus Labs, September 18, 2024, Source grade T1

    More than 200,000 compromised devices, botnet architecture

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • More than 200,000 consumer devices including routers, IP cameras, DVRs, and network attached storage were affected.
  • The OFAC designation of Integrity Technology Group is a separate action and is not counted as a charge.