Lumen Technologies today released its CISO Update to the 2026 Lumen Defender Threatscape Report, showing that trends identified earlier this year have accelerated: threat actors are moving faster, operating at greater scale and quickly rebuilding after disruption. In one example, attackers began targeting a newly disclosed vulnerability within 24 hours, and more than 100 attack servers were involved within 72 hours.
The new report is based on intelligence from Black Lotus Labs, Lumen’s threat research and intelligence team, which monitors activity across Lumen’s internet backbone.
Among the report’s findings:
- AI and automation reduce the time between vulnerability discovery and
exploitation. Over three weeks, Black Lotus Labs observed a campaign launch more than 65 million attacks against more than 10,000 Fortinet devices using AI tools to automate the intrusions. With this persistent pace, even a temporary misconfiguration could lead to compromise.
- Constant pressure has become the norm. In the first half of 2026, Black Lotus Labs detected nearly 4,000 brute force attacks and exploit scanners per day on average. They were aimed at firewalls, VPNs and other internet-connected equipment, showing attackers care more about whether a device is exposed than who owns it.
- Criminal infrastructure is becoming regenerative. Activity linked to potential proxy-device recruitment quadrupled during the first half of the year, showing how home devices like phones and streaming boxes help replenish attackers’ stores. Additionally, IPIdea rebuilt its proxy network to nearly 112% of its previous size less
than six months after a disruption effort.
- Backbone visibility is designed to reveal attacker activity before public vulnerability disclosures. Black Lotus Labs observed infrastructure tied to a recent exploitation campaign more than three weeks before the vulnerability was publicly identified, helping researchers spot activity before traditional endpoint alerts or vendor disclosures.
These findings are part of a wider pattern: that established threats are becoming faster, broader and more persistent, as AI and automation shorten the path from finding a weakness to exploiting it.
Black Lotus Labs and Network Visibility
With visibility into 99% of public IPv4 addresses and hundreds of billions of daily network observations, Black Lotus Labs leverages Lumen’s position as the operator of the world’s most deeply peered network. With this, they can identify threats three to 21 days sooner than other threat feeds and help disrupt malicious activity before it reaches intended targets.
Black Lotus Labs combines this network visibility, AI-powered analytics, automation and multidisciplinary expertise to turn internet-scale data into actionable threat intelligence that helps organizations stay ahead of rapidly evolving threats.
The full report is available at 2026 Threatscape Report | Lumen Technologies.
Related
This entry was posted on November 10, 2026 at 8:31 am and is filed under Commentary with tags Lumen. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Latest Lumen Report: Cyber Threats Are Moving Faster, Bouncing Back Stronger
Lumen Technologies today released its CISO Update to the 2026 Lumen Defender Threatscape Report, showing that trends identified earlier this year have accelerated: threat actors are moving faster, operating at greater scale and quickly rebuilding after disruption. In one example, attackers began targeting a newly disclosed vulnerability within 24 hours, and more than 100 attack servers were involved within 72 hours.
The new report is based on intelligence from Black Lotus Labs, Lumen’s threat research and intelligence team, which monitors activity across Lumen’s internet backbone.
Among the report’s findings:
exploitation. Over three weeks, Black Lotus Labs observed a campaign launch more than 65 million attacks against more than 10,000 Fortinet devices using AI tools to automate the intrusions. With this persistent pace, even a temporary misconfiguration could lead to compromise.
than six months after a disruption effort.
These findings are part of a wider pattern: that established threats are becoming faster, broader and more persistent, as AI and automation shorten the path from finding a weakness to exploiting it.
Black Lotus Labs and Network Visibility
With visibility into 99% of public IPv4 addresses and hundreds of billions of daily network observations, Black Lotus Labs leverages Lumen’s position as the operator of the world’s most deeply peered network. With this, they can identify threats three to 21 days sooner than other threat feeds and help disrupt malicious activity before it reaches intended targets.
Black Lotus Labs combines this network visibility, AI-powered analytics, automation and multidisciplinary expertise to turn internet-scale data into actionable threat intelligence that helps organizations stay ahead of rapidly evolving threats.
The full report is available at 2026 Threatscape Report | Lumen Technologies.
Share this:
Like this:
Related
This entry was posted on November 10, 2026 at 8:31 am and is filed under Commentary with tags Lumen. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.