Lumen Q3 revenue falls 12% to $2.72 billion after fiber-to-home sale; Strategic revenue up 10%, net loss narrows to $265 million. Key points * Revenue fell 12% to $2.715 billion; Mass Markets revenue dropped 42% to $369 million after the Q1 2026 sale of the fiber-to-the-home business to AT&T [[1]]. * Strategic business revenue grew 10% to $1.279 billion while Legacy revenue fell 17% [[1]]. * Net loss was $265 million, or $0.26 a share, versus $621 million a year earlier; Lumen reiterated 2026 adjusted EBITDA guidance of $3.1 billion to $3.3 billion excluding special items [[1]]. Lumen Technologies reported third-quarter revenue of $2.715 billion, down 12% from $3.087 billion a year earlier, as the sale of its Mass Markets fiber-to-the-home business to AT&T in the first quarter cut consumer revenue 42% to $369 million [[1]]. The business side is shifting toward newer services: Strategic revenue grew 10% to $1.279 billion, 55% of business revenue, while Legacy revenue fell 17% to $1.067 billion. Total business revenue declined 4% to $2.346 billion [[1]]. Quarter at a glance. | Metric | Q3 2026 | Q2 2026 | Q3 2025 | | Revenue | $2,715M | $2,805M | $3,087M | | Margin after cost of services* | 47.3% | 49.6% | 44.9% | | Operating income (loss) | $(167)M | $(88)M | $(116)M | | Net income (loss) | $(265)M | $(201)M | $(621)M | | Diluted EPS | $(0.26) | $(0.20) | $(0.62) | | Strategic revenue | $1,279M | $1,289M | $1,167M | | Mass Markets revenue | $369M | $361M | $631M | *Lumen does not report gross profit; this is revenue less cost of services and products, which excludes depreciation. Prior-quarter income figures are from MLQ's SEC-derived financials [[2]]. Losses, cash and guidance. The narrower net loss reflects lower interest expense, $189 million against $319 million, and the absence of last year's $395 million loss on early debt retirement. Adjusted EBITDA excluding special items fell to $715 million from $787 million, though the margin rose to 26.3%. Free cash flow excluding special items was negative $76 million [[1]]. Lumen reiterated full-year 2026 guidance for adjusted EBITDA of $3.1 billion to $3.3 billion and free cash flow of $1.9 billion to $2.1 billion, both excluding special items, with capital spending of $3.2 billion to $3.4 billion. The free-cash-flow range includes $729 million of divestiture proceeds [[1]]. "AI-driven demand for connectivity is fueling momentum in our Strategic revenue base," CEO Kate Johnson said. CFO Chris Stansbury said Lumen remains on track for an adjusted EBITDA inflection this year and a return to business revenue growth in 2028 [[1]]. Companies mentioned. At the intersection of AI, tech, and markets. The stories that matter, in one email. Free - unsubscribe anytime.

Industry takedown of botnet hidden in more than 34,000 Android TV set-top boxes in Australian households. TrendAI | Published 5 Nov 2026 COMPANY NEWS: TrendAI(TM) coordinates efforts with private and public sector partners to disrupt global X.CPE botnet, opening homes and offices to malicious actors TrendAI(TM) has today announced the coordinated takedown of X.CPE, a global botnet hidden in more than 1.3 million set-top boxes across more than 200 countries, including 34,206 devices in Australia. Hidden on devices before they were ever sold, the botnet used subscribers' devices and home internet connections without their knowledge or consent. Australia was among the Top 10 countries where devices were observed, with 34,206 pre-infected devices discovered. The takedown was led by TrendAI(TM), Google, Plume, Lumen, HUMAN Security and Synthient, along with Japan's National Police Agency. Charley Snyder, Head of Disruption Operations at Google Threat Intelligence Group: "Operations like this raise the cost for criminals and show that the infrastructure they rely on isn't out of reach. Disrupting X.CPE took partners across industry working together. It's proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries." Robert McArdle, Director of Cybercrime Research at TrendAI(TM): "We applaud Google's decisive action in removing this threat. Our research identified over 1.3 million devices affected by this campaign, including 34,206 pre-infected home devices in Australia. That's thousands of Australian households and businesses completely unaware that their devices and home-internet was being used as an accessory in active criminality. "As the adoption of connected home solutions grows across Australia, there will be more hidden risks inside the devices used every day. This collaborative effort with Google and research partners significantly sets back these attackers, and TrendAI(TM) Research will be watching them closely if they attempt to rebuild." A familiar device hiding an unfamiliar threat X.CPE was embedded in firmware, the software that controls a device's basic operations, before set-top boxes reached subscribers' homes. X.CPE was built to evade pre-release security checks, and Google has since updated its review process in response, as well as banned the responsible OEM and any future subsidiaries or affiliates from making devices with preloaded Google apps. Unlike infections that depend on a user opening a suspicious attachment or installing an application, this threat arrived as part of the device itself. Subscribers received no consent request, notification or opt-out options. TrendAI(TM) worked with partners Google, Plume, Lumen, HUMAN Security, Synthient and Japan's National Police Agency, to carry out a coordinated disruption campaign against X.CPE. Each organisation contributed in its own way, applying its expertise in connected-device security, malware analysis, network visibility and digital fraud to analyse the botnet and disrupt its operations. Together they dismantled a threat hiding behind seemingly routine device activity: software embedded in TV set-top boxes that gave botnet controllers remote access and allowed them to exploit home broadband connections without subscriber consent. The takedown also disrupted the command-and-control domains that operate the criminal affiliates' malware modules. Because these affiliates distribute their modules through channels beyond X.CPE, Google assesses that taking down these domains will sever access to at least 10 million additional compromised devices. The effort demonstrates the importance of connecting intelligence across organisations to confront threats that cross technology and network boundaries. By bringing together distinct perspectives on compromised devices, malicious software and internet traffic, the partners supported a coordinated takedown aimed at disrupting unauthorised access and monetisation and addressing risks to subscriber privacy, broadband resources and trust in connected devices. Turning home broadband into a business without permission The botnet generated revenue from compromised devices in a variety of ways, including: reselling bandwidth, delivering video content, ad fraud, loading additional backdoors and, in earlier versions, installing apps for payment. Residential proxy software allowed third-party traffic to pass through subscribers' internet connections, using their home internet addresses and bandwidth without permission. Researchers also found collection of device, network and account information, alongside persistent remote access capabilities. For service providers, the findings highlight a supply chain risk that may not be apparent from a device's everyday performance. A functioning streaming box can still generate unexplained traffic and undermine trust in the broadband service. "Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect," said Chris Griffiths, Chief Technology Officer at Plume. "By contributing broadband intelligence to this joint effort, we helped expose hidden supply chain risks and support coordinated action to make networks safer for service providers and their subscribers." Research and resources:

Industry takedown of botnet hidden in more than 1.3 million TV set-top boxes across 200 countries. 02/11/2026 Google, Plume, TrendAI(TM), Lumen, HUMAN Security, Synthient and Japan's National Police Agency form coordinated effort combining security research, threat intelligence and network expertise to identify and disrupt X.CPE botnet MOUNTAIN VIEW, Calif., Nov. 2, 2026 /PRNewswire/ - Today, a group of private and public sector partners announced a coordinated takedown of X.CPE, a global botnet hidden in more than 1.3 million set-top boxes across more than 200 countries. Hidden on devices before they were ever sold, the botnet used subscribers' devices and home internet connections without their knowledge or consent. This takedown was led by Google, Plume, TrendAI(TM), Lumen, HUMAN Security and Synthient, along with Japan's National Police Agency. Google, Plume, TrendAI(TM), Lumen, HUMAN Security, Synthient and Japan's National Police Agency join coordinated effort combining security research, threat intelligence and network expertise to identify and disrupt X.CPE botnet. "Operations like this raise the cost for criminals and show that the infrastructure they rely on isn't out of reach," said Charley Snyder, Head of Disruption Operations at Google Threat Intelligence Group. "Disrupting X.CPE took partners across industry working together. It's proof that collaboration is one of the most powerful tools we have against threats that cross borders and industries." A familiar device hiding an unfamiliar threat X.CPE was embedded in firmware, the software that controls a device's basic operations, before set-top boxes reached subscribers' homes. X.CPE was built to evade pre-release security checks, and Google has since updated its review process in response, as well as banned the responsible OEM and any future subsidiaries or affiliates from making devices with preloaded Google apps. Unlike infections that depend on a user opening a suspicious attachment or installing an application, this threat arrived as part of the device itself. Subscribers received no consent request, notification or opt-out options. Google, Plume, TrendAI(TM), Lumen, HUMAN Security, Synthient, working with Japan's National Police Agency, carried out a coordinated disruption campaign against X.CPE. Each organization contributed in its own way, applying its expertise in connected-device security, malware analysis, network visibility and digital fraud to analyze the botnet and disrupt its operations. Together they dismantled a threat hiding behind seemingly routine device activity: software embedded in TV set-top boxes that gave botnet controllers remote access and allowed them to exploit home broadband connections without subscriber consent. The takedown also disrupted the command-and-control domains that operate the criminal affiliates' malware modules. Because these affiliates distribute their modules through channels beyond X.CPE, Google assesses that taking down these domains will sever access to at least 10 million additional compromised devices. The effort demonstrates the importance of connecting intelligence across organizations to confront threats that cross technology and network boundaries. By bringing together distinct perspectives on compromised devices, malicious software and internet traffic, the partners supported a coordinated takedown aimed at disrupting unauthorized access and monetization and addressing risks to subscriber privacy, broadband resources and trust in connected devices. Turning home broadband into a business without permission The botnet generated revenue from compromised devices in a variety of ways, including: reselling bandwidth, delivering video content, ad fraud, loading additional backdoors and, in earlier versions, installing apps for payment. Residential proxy software allowed third-party traffic to pass through subscribers' internet connections, using their home internet addresses and bandwidth without permission. Researchers also found collection of device, network and account information, alongside persistent remote access capabilities. For service providers, the findings highlight a supply chain risk that may not be apparent from a device's everyday performance. A functioning streaming box can still generate unexplained traffic and undermine trust in the broadband service. "Protecting the connected home requires visibility into threats that subscribers cannot see and should not be expected to detect," said Chris Griffiths, Chief Technology Officer at Plume. "By contributing broadband intelligence to this joint effort, we helped expose hidden supply chain risks and support coordinated action to make networks safer for service providers and their subscribers." Complementary expertise, coordinated action The partners contributed to the Google-led effort to disrupt X.CPE: TrendAI(TM) Robert McArdle, Director of Cybercrime Research at TrendAI(TM) "We applaud Google's decisive action in removing this threat. Our research identified over 1.3 million devices affected by this campaign. That's millions of households and businesses completely unaware that their equipment was being used as an accessory in active criminality - whether defrauding advertisers or piggybacking on their connections to carry out other attacks via residential proxies - which would commonly include identity theft impersonating people in their region. This action by Google and research partners significantly sets back these attackers, and TrendAI research will be watching them closely if they attempt to rebuild." HUMAN Gavin Reid, CISO at HUMAN "Compromised-device networks are sustained by profit: operators take control of devices and household connections without consent, then monetise that access through proxy services and various fraud activities. Group action, as exemplified in this operation, interrupts the infrastructure needed for monetisation, raising the cost of operating these networks and weakening the incentives that sustain them." SYNTHIENT Benjamin Brundage, CEO at Synthient. "Illicit pay-per-install networks provide a significant backbone to the larger fraud ecosystem, powering everything from direct ad fraud to unregulated proxy networks that push credential stuffing and DDoS botnets. The takedown of X.Cpe helps protect this space as a whole, as well as the unsuspecting consumers victimized by this scheme." - Benjamin Brundage Research and resources: About Plume Plume provides an AI-powered platform that enables internet service providers improve connectivity, security and the subscriber experience. Combining cloud-managed Wi-Fi, network intelligence and customer care orchestration, Plume helps service providers across more than 60 countries build subscriber confidence and operate more efficiently. More details about Plume. About TrendAI(TM) TrendAI(TM), the global AI security leader and enterprise business unit of Trend Micro, empowers organizations with full AI visibility, governance, and consolidated security that inspires confidence, drive innovation, and eliminate risk. Trusted by the largest enterprises and governments across 185 countries, TrendAI(TM) secures the entire organization, from identities to infrastructure to data. Global Fortune 500 companies rely on TrendAI(TM) to stop threats up to 115 days earlier, powered by world-leading threat and attack intelligence. More details about trendaisecurity.com. About Lumen Lumen Technologies connects people, data and applications through its network and technology services. Its Black Lotus Labs threat research and operations team uses global network visibility to identify malicious activity, generate threat intelligence and help protect businesses and the internet. More details about Lumen Technologies. About HUMAN Security HUMAN Security helps organizations protect digital experiences by detecting and disrupting automated threats, fraud and abuse. Its technology and threat intelligence help enterprises and platforms verify digital interactions and establish trust across the customer journey. More details about humansecurity.com. About Synthient Synthient provides intelligence to identify residential proxies, VPNs and bot infrastructure, helping organizations assess traffic risk and investigate abuse. Its researchers analyze proxy networks, botnets and adversary infrastructure to expose emerging threats. More details about Synthient. 18/08/2014 02/07/2026 13/05/2026 27/04/2026 30/04/2026 Discover more Public safety technology Bot development services Public safety software Blog 03/11/2026 Blog 02/11/2026