Riding the raptor train: How Flax Typhoon hijacked xIoT

Riding the Raptor Train: How Flax Typhoon Hijacked xIoT

Over a million everyday devices—routers, IP cameras, NAS boxes—quietly compromised and turned into a weaponized army. This is Raptor Train, a sprawling, multi-tiered botnet engineered by the Chinese state-aligned threat actor Flax Typhoon.

Using a memory-resident Mirai variant called Nosedive and a full-featured control system named Sparrow, the operators created a resilient infrastructure capable of exploitation at scale, evasive persistence, and real-time device management across tens of thousands of nodes.

This session will unpack how it works, what devices were hit, and why this signals a new phase in IoT botnet evolution—one that blends espionage-grade tooling with mass exploitation tactics.