cyber.hendryadrian.com
Interesting Stuff · lumen.com

How Threat Intelligence Turns Raw Indicators Into Actionable Security Insights

· Original article ↗

Summary

Lumen describes how Black Lotus Labs combines network visibility, third-party intelligence, analytics and researcher validation to contextualize threats and help security teams investigate and respond.

Key points

  • Black Lotus Labs combines proprietary network observations with commercial, open-source and community intelligence to broaden its view of threats.
  • Researchers correlate and enrich indicators with infrastructure, ownership, behavior and historical observations to provide context beyond isolated IP addresses, domains or hashes.
  • The article says Black Lotus Labs observed infrastructure linked to a Check Point exploitation campaign more than three weeks before the vulnerability was publicly identified.
  • The article describes Black Lotus Labs supporting the FBI and DOJ's KV Botnet takedown; it reports observing NETGEAR ProSAFE firewalls used as relay nodes from July 2022 through February 2023.
  • The article says Microsoft assessed that the Volt Typhoon-associated campaign sought to disrupt critical communications infrastructure between the United States and Asia during future crises.
  • Threat intelligence can help analysts investigate suspicious connections, identify related infrastructure and affected systems, and contain potential activity; it can also support DDoS protection.
  • The intelligence is integrated into Lumen offerings, including Lumen Defender, Lumen DDoS protection and Defender Threat Feed.

Article Details

Topic
How Black Lotus Labs combines network visibility, third-party intelligence, analytics, and researcher validation to produce actionable threat intelligence

People

Larry CallahanLumen Director of Specialized Sales and Security; discusses operationalizing threat intelligence.Mark DehusBlack Lotus Labs Principal Security Researcher; discusses correlating threat infrastructure and validating intelligence.

Threat Actors

Volt TyphoonState-sponsored actor based in China; the article associates it with the KV Botnet and activity involving compromised relay networks.

Malware

KV BotnetLabs’ work supporting the FBI and Department of Justice (DOJ) in supporting their takedown of the “KV Botnet” associated with “Volt Typhoon,” a state-sponsored actor based in China that typically focuses on

Vendors

Lumen TechnologiesIntelligence generated by Black Lotus Labs powers multiple security outcomes across the Lumen Defender ℠ security portfolio, including threat detection, DDoS protection and infrastructure defense.

Products

Defender Advanced Managed Detection and Response (AMDR)including Lumen Defender℠, Lumen DDoS protection, Defender Threat Feed and Defender Advanced Managed Detection and Response (AMDR) services to help customers identify and respond to threats more effectively.Defender Threat Feedintelligence is integrated into Lumen products including Lumen Defender℠, Lumen DDoS protection, Defender Threat Feed and Defender Advanced Managed Detection and Response (AMDR) services to help customers identifyLumen DDoS protectionThis intelligence is integrated into Lumen products including Lumen Defender℠, Lumen DDoS protection, Defender Threat Feed and Defender Advanced Managed Detection and Response (AMDR) services to help customersLumen DefenderIntelligence generated by Black Lotus Labs powers multiple security outcomes across the Lumen Defender ℠ security portfolio, including threat detection, DDoS protection and infrastructure defense.

Countries

Chinatheir takedown of the “KV Botnet” associated with “Volt Typhoon,” a state-sponsored actor based in China that typically focuses on espionage and information gathering. From July 2022 through February 2023, BlackUnited Statesthat the campaign was attempting to disrupt critical communication infrastructure between the United States and Asia during future crises.

Related Articles