Raptor Train Paradox: A Multi-Tiered Botnet Phenomenon

The Raptor Train botnet framework, active since mid-2020, has evolved into a sophisticated, multi-tiered network primarily targeting small office/home office (SOHO) networks and Internet of Things (IoT) devices. Likely operated by Chinese nation-state cybercriminals known as Flax Typhoon, the botnet had expanded significantly by June 2024, with its database growing to over 1.2 million compromised devices globally, including more than 385,000 unique U.S. victims. Linked to four major cyber campaigns, this ever-evolving botnet highlights the increasing complexity and persistence of nation-state cyberattacks