Vendor

Lumen

0 mentions in 7 days · 3 in 30 days · 3 total · first seen Aug 31, 2026 · last 12d ago

Timeline3 articles

Outsider Phishing Kit Survives Takedown With 700 New Pages

Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.

Group-IB linked the Outsider Phishing Kit, operated by a threat actor known as ChenLun, to more than 100,000 phishing pages across 54+ countries between December 2025 and May 2026. After the FBI, Google, and Lumen's Black Lotus Labs seized core admin servers, a Shopify storefront, about $100,000, and thousands of domains under Operation Ghost Hook in June, over 700 new phishing domains appeared within a month. The kit offered 267 templates, adversary-in-the-middle MFA interception, WebSocket-based live operator communication, and SMS delivery via a Telegram affiliate ecosystem with more than 5,000 subscribers.

Infosecurity MagazineSep 3, 14:00 UTC · 12d agoPhishing & fraud in the wild1

Srsly Risky Biz: China's Private Sector Botnets Are Worth Disrupting

DoJ seized domains of Chinese espionage botnet platforms QScan and QTRouter, run by private firm QTFY for MSS and PLA targeting.

The US Department of Justice disrupted QScan, a distributed vulnerability scanning system with nearly a decade of internet scanning data, and QTRouter, a covert communications platform routing traffic through compromised IoT devices, operated by QTFY under Chinese company Nanjing Xinjiuwei Network Technology. FBI and NSA advisories say QTFY customers include China's Ministry of State Security and the People's Liberation Army, targeting federal agencies, the US Senate, hospitals, telecoms and financial institutions. This is the third Chinese state-backed botnet disrupted since December 2023, following the KV botnet (Volt Typhoon) and Raptor Train (Flax Typhoon), and a sister network, JDY, has more than doubled since the KV disruption. Separately, the Qilin ransomware group claimed a breach of the ATF's CALEA system, briefly publishing 6.3 GB of case folders and forensic data.

Risky Business NewsSep 3, 04:29 UTC · 12d agoThreat actor1

DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims

DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.

The US Department of Justice revised its press release to list NASA, the Federal Reserve, Department of Energy, DoJ, HHS, NIH and the US Senate as 'among the targets' of QTFY (aka QT AND QTCYBER), rather than victims. QTFY, active since 2018 and linked to Nanjing Xinjiuwei Network Technology Co with payments suggesting MSS sponsorship, operates the QScan vulnerability scanning platform and QTRouter obfuscation network, which underpin the Fast Labyrinth encrypted ORB relay network built from infected IoT devices and leased VPSs. The FBI seized qtproxy[.]xyz, qt-proxy[.]org and qt-team[.]com, disrupting QScan and QTRouter, while Lumen Black Lotus Labs reported the actor industrialized ORB networks for China-linked espionage. A 2019 NASA intrusion attempt exploited CVE-2019-11510, a critical Pulse Secure VPN flaw.

The Hacker NewsAug 31, 07:56 UTC · 15d agoThreat actor in the wildCVE-2019-11510

Related CVEsby mentions

CVE-2019-1151010.0100%
Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known.
· Ivanti Pulse Connect Secure KEV ransomware PoC ×2large

Appears with

organization FBI 3 organization Ministry of State Security 2 product QScan 2 product QTRouter 2 threat actor Volt Typhoon 1 organization Black Lotus Labs 1 organization Department of Justice 1 organization Nanjing Xinjiuwei Network Technology 1 organization NSA 1 organization Operation Ghost Hook 1 organization People's Liberation Army 1 organization US Department of Justice 1 product Black Lotus Labs 1 product CALEA 1 product Fastlink 1 product Outsider Phishing Kit 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.