Lumen Black Lotus Labs

Mentions · 7d1
Mentions · 30d2
All mentions5
First seenAug 18, 2026
Last mentioned1d ago

Timeline

5 articles · newest first

KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127

UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.

GBHackersupdated Oct 30, 00:10 UTC · 1d agofirst Oct 29, 13:27 UTC · 1d agoMalwareExploited14 sourcesCVE-2026-201271

PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

PoeLLM malware has infected over 3,400 servers to build a cryptomining botnet called Canto Incognito.

The Hacker Newsupdated Oct 8, 09:14 UTC · 22d agofirst Oct 7, 15:33 UTC · 23d agoMalwareExploited6 sources7 · 4 reads

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.

The Hacker Newsupdated Sep 11, 14:29 UTC · Sep 11, 2026first Sep 11, 14:10 UTC · Sep 11, 2026Threat actorExploited2 sources8 · 4 reads

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.

The Hacker NewsSep 2, 06:26 UTC · Sep 2, 2026Threat actorExploitedCVE-2018-13379 CVE-2019-10068 CVE-2019-19781+106 · 1 read

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.

The Hacker NewsAug 18, 12:13 UTC · Aug 18, 2026Malware2 · 1 read

Related CVEs

by mentions

CVE-2021-44228100%10.0
JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)
published Dec 10, 2021Apache Log4j2KEVRansomwarePoC ×9
CVE-2026-2012789%10.0
Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
published Feb 25, 2026Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)KEV
CVE-2020-5902100%9.8
Unauthenticated RCE via path traversal in F5 BIG-IP TMUI
published Jul 1, 2020F5 BIG-IPKEVRansomwarePoC ×8
CVE-2025-31161100%9.8
Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
published Apr 3, 2025CrushFTPKEVRansomwarePoC ×5
CVE-2018-13379100%9.8
Unauthenticated Path Traversal in Fortinet FortiOS SSL VPN
published Jun 4, 2019Fortinet FortiOSKEVRansomware
CVE-2024-896399%9.1
Unauthenticated Path Traversal in Ivanti Cloud Services Appliance
published Sep 19, 2024Ivanti Cloud Services Appliance (CSA)KEV
CVE-2021-26855100%9.1
Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
published Mar 3, 2021Microsoft Exchange ServerKEVRansomwarePoC ×4
CVE-2024-24919100%8.6
Information Disclosure in Internet-Facing Check Point Quantum Security Gateways
published May 28, 2024Check Point Quantum Security GatewaysKEVRansomware
CVE-2024-938058%7.2
OS Command Injection RCE in Ivanti Cloud Services Appliance Admin Console
published Oct 8, 2024Ivanti Endpoint Manager Cloud Services Appliance (CSA)KEV
CVE-2024-819089%7.2
OS Command Injection RCE in Ivanti Cloud Services Appliance 4.6
published Sep 10, 2024Ivanti Cloud Services ApplianceKEV

Appears with

Microsoftvendor · 2
WUEnginemalware · 1
Kenticovendor · 1
Lumen Technologiesorganization · 1
Gotenbergproduct · 1
FBIorganization · 1
GiftDropmalware · 1
Claudeproduct · 1
QTRouterproduct · 1
Ironmalware · 1
DarkSwordmalware · 1
APT29threat actor · 1
Cisco Talosorganization · 1
Department of Energyvictim · 1
ValleyRATmalware · 1
Darktracevendor · 1

Entities are extracted by the model from each article. First seen Aug 18, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.