Black Lotus Labs®

Discover how Lumen cybersecurity experts and advanced threat technology identify and eliminate threats fast with detailed analyses by Black Lotus Labs®, the Lumen threat intelligence team.

A person with short hair and wearing glasses sits at a desk, writing while looking at an open laptop with a glass of water and papers nearby.

November 10, 2026

AI attack acceleration: how CISOs can respond

Harry Rossoff

AI attack acceleration is shrinking defenders’ response time. See our latest research to learn how network intelligence helps CISOs detect and block threats earlier.

A train called the zero-day express quietly rides on a track made of pillows over a bridge made of digits

October 28, 2026

Silent Train: Volt Typhoon’s Zero-Day Exploitation | Lumen

Black Lotus Labs

See how Black Lotus Labs tracked Volt Typhoon’s covert network, helping Lumen alert hundreds of affected customers over three years.

A bot searches a poetry book for the key to finding the command-and-control address used by the botnet operator. Victim bots are outside mining cryptocurrency.

October 7, 2026

Canto incognito: tracking the PoeLLM malware

Black Lotus Labs

Understand how early detection helped Black Lotus Labs uncover PoeLLM malware targeting enterprise AI systems and block its infrastructure to protect customers.

A business professional in a green turtleneck sits at their desk, looking intently at the desktop in front of them. There is a large, blurred screen in the background, showing code that spans the wall.

Sept 22, 2026

Threat Intelligence Gives Security Data Meaning

Harry Rossoff

Learn about cyberthreat intelligence and how Black Lotus Labs uses proprietary network visibility and third-party intelligence sources to not only identify threats but provide the intelligence that enables teams to act on that information.

A view of the operations behind the publish and subscribe system that the attacker uses to control victims through the MQTT communications protocol.

September 15, 2026

The banana stand: brokering and managing infections across Asia using MQTT

Black Lotus Labs

Early detection of BambooToken’s MQTT C2 can help security teams uncover stealthy malware before threats spread. Learn why you should act now.

A view of a large supply warehouse named "Proxy Supply ltd." The warehouse looks well maintained, there is a flagpole in the parking lot with the symbol of a typhoon on the flag

August 26, 2026

Inside China-nexus cyber espionage infrastructure

Black Lotus Labs

Black Lotus Labs and the FBI uncovered China-nexus infrastructure used to hide cyber espionage, showing how early detection helps protect customers.

Show More