Latest Lumen Report: Cyber Threats Are Moving Faster, Bouncing Back Stronger

Lumen Technologies (Nasdaq: LUMN) released a cybersecurity report update describing faster exploitation and more persistent attacks in the first half of 2026.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Findings show faster exploitation, relentless attacks on internet-facing systems, and increasingly resilient criminal infrastructure in first half of 2026

DENVER--(BUSINESS WIRE)-- Lumen Technologies (Nasdaq: LUMN) today released its CISO Update to the 2026 Lumen Defender Threatscape Report, showing that trends identified earlier this year have accelerated: threat actors are moving faster, operating at greater scale and quickly rebuilding after disruption. In one example, attackers began targeting a newly disclosed vulnerability within 24 hours, and more than 100 attack servers were involved within 72 hours.

Threatscape Report: Stop the attack before the alert.

The new report is based on intelligence from Black Lotus Labs, Lumen's threat research and intelligence team, which monitors activity across Lumen's internet backbone.

"Cybersecurity is a race without a finish line," said Lumen Chief Security Officer Kim Keever. "Attackers are constantly probing internet-facing infrastructure, quickly shifting to new opportunities and rebuilding resources when they're disrupted. For security leaders, the takeaway is clear: Reducing exposure and identifying malicious activity earlier in the attack cycle have never been more important."

Among the report's findings:

• AI and automation reduce the time between vulnerability discovery and exploitation. Over three weeks, Black Lotus Labs observed a campaign launch more than 65 million attacks against more than 10,000 Fortinet devices using AI tools to automate the intrusions. With this persistent pace, even a temporary misconfiguration could lead to compromise.
• Constant pressure has become the norm. In the first half of 2026, Black Lotus Labs detected nearly 4,000 brute force attacks and exploit scanners per day on average. They were aimed at firewalls, VPNs and other internet-connected equipment, showing attackers care more about whether a device is exposed than who owns it.
• Criminal infrastructure is becoming regenerative. Activity linked to potential proxy-device recruitment quadrupled during the first half of the year, showing how home devices like phones and streaming boxes help replenish attackers’ stores. Additionally, IPIdea rebuilt its proxy network to nearly 112% of its previous size less than six months after a disruption effort.
• Backbone visibility is designed to reveal attacker activity before public vulnerability disclosures. Black Lotus Labs observed infrastructure tied to a recent exploitation campaign more than three weeks before the vulnerability was publicly identified, helping researchers spot activity before traditional endpoint alerts or vendor disclosures.

These findings are part of a wider pattern: that established threats are becoming faster, broader and more persistent, as AI and automation shorten the path from finding a weakness to exploiting it.

Black Lotus Labs and Network Visibility

With visibility into 99% of public IPv4 addresses and hundreds of billions of daily network observations, Black Lotus Labs leverages Lumen's position as the operator of the world's most deeply peered network. With this, they can identify threats three to 21 days sooner than other threat feeds and help disrupt malicious activity before it reaches intended targets.

Black Lotus Labs combines network visibility with AI-powered analytics, automation, and industry expertise to turn internet-wide data into actionable threat intelligence that helps organizations stay ahead of rapidly evolving threats.

The full report is available at 2026 Threatscape Report | Lumen Technologies.

• Black Lotus Labs threat intelligence helps detect and block threats in Lumen Defender and Lumen DDoS, reducing risk and easing the burden on security teams. Learn more: Secure your network and improve threat protection | Lumen Technologies

About Lumen Technologies

Lumen is unleashing the world's AI potential. As the trusted network for AI, we ignite business growth by connecting people, data, and applications — quickly, securely, and effortlessly. Lumen’s physical infrastructure, programmable network, and connected ecosystem give enterprises a simpler way to move data from virtually anywhere to anywhere in real-time to support their AI needs. Together, Lumen’s owned fiber backbone and cloud-native control plane provide a differentiated platform for connecting, securing, and operating modern enterprise environments at global scale. From metro connectivity and long-haul data transport to cloud networking, security services, digital platform capabilities, and connectivity orchestration, Lumen meets customers’ needs today and as they build for tomorrow. Lumen and Lumen Technologies are registered trademarks of Lumen Technologies, Inc. in the United States.

Forward Looking Statement

This press release contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. All statements contained in this press release that do not relate to matters of historical fact should be considered forward-looking statements, including statements regarding Lumen Intelligent Internet, its expected availability, functionality, scalability, customer adoption, benefits, future enhancements, and market demand, as well as Lumen's business, strategy, and operations as well as statements identified by words such as “estimates,” “expects,” “anticipates,” “believes,” “plans,” “intends,” “will,” and similar expressions. These forward-looking statements are not promises nor guarantees of future results, are based on our current expectations only and are subject to various risks and uncertainties that could cause actual results to differ materially from those expressed or implied, including those described in our most recent Annual Report on Form 10-K and Quarterly Report on Form 10-Q, as updated in our other filings with the U.S. Securities and Exchange Commission from time to time. Lumen undertakes no obligation to update any forward-looking statements except as required by law.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261110372401/en/

Media Contact:
Danielle Spears
Danielle.Spears@Lumen.com
+1 321 256 3854

Source: Lumen Technologies

Key Terms

brute force attacks technical

A brute force attack is an automated method for gaining unauthorized access by systematically trying large numbers of possible passwords, encryption keys, or authentication tokens until one works. Attackers use software to generate and submit guesses very quickly, often using lists of common passwords, dictionary words, or randomized combinations; the effectiveness depends on how many attempts the attacker can make before defenses like rate limits, account lockouts, or multi-factor authentication stop them. Because brute force attacks rely on trial-and-error rather than exploiting a specific vulnerability, their success falls as credential complexity and protective controls increase.

vpns technical

A VPN (virtual private network) creates a secure, private ‘tunnel’ for internet traffic that hides a user’s location and activity from outside parties and protects data when using public networks. For investors, VPNs matter because demand and regulation influence companies’ revenue, growth prospects and risk exposure—wider remote work, cybersecurity breaches, privacy laws and corporate compliance can all drive or slow adoption and therefore affect business value.

ipv4 technical

IPv4 is the set of rules that gives every device on the internet a unique address, like a street address for computers so data knows where to go. It matters to investors because those addresses are limited and running out, creating costs and business opportunities for networks, data centers and address brokers, and signaling infrastructure upgrades as companies move toward newer addressing systems.