[Back to the takedown index](https://takedownindex.org/takedowns) # Raptor Train botnet disruption September 2024, State sponsored Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation) Verified core entry, last reviewed August 21, 2026 What was taken down? Control of the botnet infrastructure seized; malware disabled on compromised devices; operators' attempt to migrate the botnet was countered.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? No individual outcomes are recorded against this entry. Group accounted for: Not applicable [See people and accountability](#people) Did it stay down? Not established in the public record. No later activity is recorded against this entry. [See what happened afterward](#afterward) ## What happened Court-authorized DOJ and FBI operation seizing control of a botnet of consumer devices operated by the PRC-linked company Integrity Technology Group, tracked as Flax Typhoon, with French assistance.[[1]](#source-1)[[2]](#source-2) Announced September 18, 2024. **Date:** September 1 to September 18, 2024 **Target:** Raptor Train, compromised iot device network **Activity:** State sponsored, Malware and botnets **Operational lead:** FBI **Partners** USAO-WDPA, Black Lotus Labs[[1]](#source-1)[[2]](#source-2) - [United States Attorney's Office for the Western District of Pennsylvania](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-western-district-of-pennsylvania), prosecuting - [Lumen Technologies Black Lotus Labs](https://takedownindex.org/organizations/lumen-technologies-black-lotus-labs), technical partner **Jurisdiction:** United States and France **Outcome:** Control of the botnet infrastructure seized; malware disabled on compromised devices; operators' attempt to migrate the botnet was countered. **Status:** Completed **Legal mechanism:** Court-authorized seizure and Rule 41 process, Western District of Pennsylvania **Group accounted for:** Not applicable ### Infrastructure 200,000 malware installations remediated. Command and control servers taken over, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | more than 200,000 malware installations | Remediated | More than 200,000 consumer devices including routers, IP cameras, DVRs, and network attached storage.[[1]](#source-1)[[2]](#source-2) | | Not published | Command and control server | Taken over | Control of the botnet infrastructure seized; an attempted migration by the operators was countered.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Not applicable State-sponsored infrastructure disruption. State-linked contractor company rather than a finite criminal operator group. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/raptor-train-botnet-disruption/organizations) ## What happened afterward Integrity Technology Group later sanctioned by OFAC in a separate action.[[1]](#source-1)[[2]](#source-2) Not established in the public record. No later activity is recorded against this entry. Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [Court-Authorized Operation Disrupts Worldwide Botnet Used by People's Republic of China State-Sponsored Hackers](https://takedownindex.org/sources/united-states-department-of-justice-court-authorized-operation-disrupts-worldwid) United States Department of Justice, September 18, 2024, Source grade P1 Seizure of botnet control, attribution to Integrity Technology Group, French assistance No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. ### Additional reporting and technical analysis 1. [Black Lotus Labs research on the Raptor Train botnet](https://takedownindex.org/sources/lumen-technologies-black-lotus-labs-black-lotus-labs-research-on-the-raptor-trai) Lumen Technologies Black Lotus Labs, September 18, 2024, Source grade T1 More than 200,000 compromised devices, botnet architecture No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - More than 200,000 consumer devices including routers, IP cameras, DVRs, and network attached storage were affected. - The OFAC designation of Integrity Technology Group is a separate action and is not counted as a charge. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 2 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [Radar/Dispossessor ransomware disruption](https://takedownindex.org/takedowns/radar-dispossessor-ransomware-disruption) - [Operation Magnus (RedLine and META infostealers)](https://takedownindex.org/takedowns/operation-magnus-redline-and-meta-infostealers) - [911 S5 botnet dismantlement](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)