Lumen says it tracks over 30 malicious proxy botnet clusters, with nearly 20 million distinct IPs daily. Its analysis describes how operators share and resell access, enabling abuse and rapid recovery after disruptions.
Lumen’s Black Lotus Labs describes a China-nexus infrastructure provider that combines target scanning, commercial proxy relays and operator access systems. Its telemetry links reconnaissance with later proxy traffic to high-value networks.
Lumen researchers describe BambooToken, a Windows and Linux malware family active since at least 2023 that uses MQTT for command and control. Their telemetry links the campaign to targets in Asia and South America.
Lumen describes how Black Lotus Labs combines network visibility, third-party intelligence, analytics and researcher validation to contextualize threats and help security teams investigate and respond.
Black Lotus Labs details PoeLLM, a campaign exploiting exposed AI and other services to mine cryptocurrency and scan for more victims. Its malware derives changing command-and-control addresses from a poem on GitHub.