BLACK LOTUS LABS®

In March 2023, Lumen Black Lotus Labs reported on a complex campaign called “HiatusRAT” that infected over 100 edge networking devices globally. 

Lumen Black Lotus Labs® identified a complex operation that infects small-office/home-office (SOHO) routers we’ve dubbed “AVrecon.”

Using Black Lotus Labs’ global visibility, we have tracked Qakbot’s more recent campaigns to observe the network structure, and gained key insights into the methods that support Qakbot’s reputation as an evasive and tenacious threat.

Lumen Black Lotus Labs identified a new campaign involving compromised routers. HiatusRAT allows threat actors to remotely interact with the system.

Black Lotus Labs is tracking a rise in misconfigured CLDAP services that are being abused in DDoS reflection attacks.