BLACK LOTUS LABS

See more threats.
Stop more attacks.

Our cybersecurity experts and advanced threat technology identify and eliminate threats fast.

BLACK LOTUS LABS

See more threats.
Stop more attacks.

Our cybersecurity experts and advanced threat technology identify and eliminate threats fast.

What is Black Lotus Labs?

The Threat Research and Operations arm of Lumen, Black Lotus Labs^® leverages unmatched network visibility to help protect your business and keep the internet clean. By powering Lumen® Rapid Threat Defense, Black Lotus Labs automates protection and proactively neutralizes threats—using global network data flows combined with machine learning algorithms to detect, classify and validate malicious actors. Learn more on the Black Lotus Labs X/Twitter feed and blog archive.

VIEW DATA SHEET

What is Black Lotus Labs?

See how Black Lotus Labs helps protect your business (1:52)

Crimeware analysis and disruption

Daily monitoring of ~46,000 C2s and ~200B+ NetFlow sessions to stay on top of emerging threats.

Crimeware analysis and disruption

Daily monitoring of ~46,000 C2s and ~200B+ NetFlow sessions to stay on top of emerging threats.

Advanced actor tracking

High network visibility and owned infrastructure allows for unprecedented tracking and proactive defense.

Advanced actor tracking

High network visibility and owned infrastructure allows for unprecedented tracking and proactive defense.

Automated threat repulsion

Proactive defense through automated threat blocking helps eliminate threats before they cause harm.

Automated threat repulsion

Proactive defense through automated threat blocking helps eliminate threats before they cause harm.

Products supported with Rapid Threat Defense

DDoS Mitigation

Activate powerful protection against single and multi‑vector attacks with minimised downtime.

LEARN MORE Get Offer

DDoS Mitigation

Activate powerful protection against single and multi‑vector attacks with minimised downtime.

Special Offer

DDoS Hyper®

Deploy multi‑layer, self‑service DDoS protection in minutes to help fortify your critical web assets.

LEARN MORE

DDoS Hyper®

Deploy multi‑layer, self‑service DDoS protection in minutes to help fortify your critical web assets.

Secure Access Service Edge (SASE)

Fortify your security at scale and simplify network management with Lumen® SASE with Fortinet®.

LEARN MORE

Secure Access Service Edge (SASE)

Fortify your security at scale and simplify network management with Lumen® SASE with Fortinet®.

Edge Protect

Protect against ransomware, malware, phishing and data exfiltration by enforcing web access policies.

LEARN MORE

Edge Protect

Protect against ransomware, malware, phishing and data exfiltration by enforcing web access policies.

Adaptive Network Security

Streamline security with a cloud‑based platform to simplify threat management for hybrid security environments.

LEARN MORE

Adaptive Network Security

Streamline security with a cloud‑based platform to simplify threat management for hybrid security environments.

Maximise efficiency with automated defence and proactively protect your critical assets against harmful cyberthreats. Learn more about how you can put Rapid Threat Defense to work for your business in our report.

VIEW REPORT

Learning Centre

Featured Blog

The Darkside Of TheMoon

Learn how Black Lotus Labs identified a long‑running campaign targeting outdated routers with “TheMoon” malware, commonly used as the foundation of a notorious, cybercriminal‑focused proxy service known as Faceless.

READ BLOG SEE ALL BLOGS

Featured Blog

The Darkside Of TheMoon

The man in the moon surrounded by constellation lines and stars with part of the moon obscured by a dark area

What people are saying

“We have that global internet backbone where we collect 200B netflow sessions per day, which allows us to parse through this data and look for who exactly is being infected.”

– Danny Adamitis, Lumen Black Lotus Labs

“We have that global internet backbone where we collect 200B netflow sessions per day, which allows us to parse through this data and look for who exactly is being infected.”

– Danny Adamitis, Lumen Black Lotus Labs

‘Lumen’s research team said the purpose of AVrecon appears to be stealing bandwidth - without impacting end‑users - in order to create a residential proxy service to help launder malicious activity…’

– KrebsonSecurity

‘Our data illustrates the winding down of operations leading up to QakBot’s seasonal ‘lull’ in operations, which appears in part to have been accelerated by good work from Lumen’s Black Lotus Labs.’

– Team Cymru