The arithmetic on the bottom tier decides how defenders should treat this. Black Lotus Labs puts the average life of a compromised device at 17 days, partly because of what the physical devices are and how they get used [12]. Holding the June 2023 peak of just over 60,000 live bots [2] therefore requires on the order of 3,500 fresh compromises per day [13]. Recruitment at that rate is a standing operation with a staffing line, not a campaign with an end date. The cumulative figure follows from it: the 200,000-plus routers, NVR/DVR units, NAS servers and IP cameras conscripted since that peak [3] is more than three times the largest concurrent population ever measured [14].
The bots never see the people driving them. Tasks start at Tier 3 "Sparrow" management nodes, route through Tier 2 command-and-control servers, and land on Tier 1 [12]. Sparrow is a Node.js backend with a cross-platform Electron front end, sitting over upwards of 60 C2 servers at any given time [5], and it ships with exploit and vulnerability management, file transfer, remote command execution and DDoS tasking [6]. Lumen's read is that the automation frees hands for exploitation and lets more operators contribute [6], which puts the ceiling on this network at headcount rather than skill.
Reputation filtering does not help. A C2 domain in the most recent campaign appeared on both the Cloudflare Radar and Cisco Umbrella top 1 million popularity lists [10]. Anything that passes traffic to popular domains passes that.
Downstream, nodes on this network made possible exploitation attempts against Atlassian Confluence servers and Ivanti Connect Secure appliances [9], while the targeting Black Lotus Labs observed covers U.S. and Taiwanese military, government, higher education, telecommunications, defense industrial base and IT organisations [8]. The camera in a branch office is upstream of somebody else's incident response.
Two limits on the evidence. No DDoS attack has been seen from Raptor Train, and the claim that the operators are holding that capability in reserve is Lumen's assessment rather than an observation [7]. And this account is the high-level one, with malware analysis and per-campaign detail held in a separate downloadable report [15], so the initial-access flaws for each device class are not in it. Lumen has null-routed traffic to the known management, C2, payload and exploitation infrastructure and warned U.S. government agencies [11]. That removes the servers. It does not remove the pool of devices that can be re-recruited at 3,500 a day.
