Black Lotus Labs
The threat-intelligence team of Lumen Technologies, a network operator. It discovered poellm and named the wider operation Canto Incognito; its report "Canto Incognito: Tracking the PoeLLM Malware" is the primary behind gadgetreview-poellm-botnet.
Its position as a backbone operator is why it can attribute through network-flow analysis, the evidence behind the moderate-confidence Italian-speaking-operator call. That is a reasonable inference from the work described, not something the source states. Thin node: only the news summary was ingested, not the full report. No same-as: recorded; no identity URL was checked beyond the report link above.