For more than two years, a Chinese state-backed threat actor has been building a botnet from unpatched SOHO routers, NAS devices, and internet-facing appliances. The actor, publicly tracked as Flax Typhoon, has been formally attributed to a Beijing-based contractor: Integrity Technology Group, also known as Yongxin Zhicheng Technology Group. New advisory data from October 2026 confirms the group remains operationally active against critical infrastructure targets.
Attribution confirmed: Integrity Technology Group
The U.S. Department of Justice, working with FBI and CISA, unsealed an indictment in September 2024 charging Integrity Technology Group with operating a botnet of approximately 200,000 compromised devices across dozens of countries. That botnet, dubbed Raptor Train by Lumen Technologies researchers, served as infrastructure for espionage operations targeting government agencies, defense contractors, telecommunications providers, and critical infrastructure operators. Updated indicators published this week confirm the group has not curtailed operations following the public indictment.
How Raptor Train compromises devices and maintains persistence
Flax Typhoon gains initial access almost exclusively through known CVEs on edge devices. Routers from ASUS, DrayTek, and Netgear, as well as Synology NAS devices and IP cameras, are the primary target classes. The group follows a consistent playbook: scan for vulnerable endpoints, exploit the CVE, deploy a custom implant to fold the device into the Raptor Train relay network, and use the relay to obscure traffic destined for actual espionage targets.
Legacy CVE reliance as a strategic choice
The most operationally significant detail about Flax Typhoon is its deliberate avoidance of zero-day vulnerabilities. The group prefers CVEs that are months or years old, exploiting the well-documented gap between disclosure and enterprise patch deployment. In operational technology environments, where patch windows are rare and device reboots carry production risk, that gap can extend to years. CVE-2022-40684, a critical authentication bypass in Fortinet FortiOS disclosed in October 2022, remains in active use by this group as recently as Q3 2026.
What defenders should do now
Organizations that operate internet-facing edge devices should treat this advisory as a direct call to audit their asset inventory. The key priorities: identify all SOHO and prosumer-grade devices on network perimeters, cross-reference firmware versions against the known CVE list in the CISA advisory, and prioritize patch deployment or device replacement. Network segmentation between OT and IT environments limits the blast radius if a perimeter device is compromised. Monitoring for anomalous outbound traffic from edge devices, particularly to unfamiliar IP ranges, should become a standard detection rule.
Infosec.ge is Georgia's dedicated cybersecurity intelligence platform, covering threat actors, vulnerabilities, and security developments across the South Caucasus and Eurasia. Get in touch to discuss research collaboration or media inquiries.