The Botnet Paradox: How a DDoS Protection Firm Became Linked to Massive Cyberattacks in Brazil

In the high-stakes world of cybersecurity, the line between "protector" and "aggressor" is often defined by intent. However, a recent investigation by KrebsOnSecurity has uncovered a disturbing anomaly: a Brazilian technology firm, Huge Networks, which specializes in shielding clients from Distributed Denial-of-Service (DDoS) attacks, has been found to be an unwitting—or perhaps compromised—facilitator for a powerful, aggressive botnet.

For years, Brazilian Internet Service Providers (ISPs) have been plagued by a series of persistent, massive digital sieges. While the identity of the orchestrator remained a mystery, a cache of leaked files has now linked this infrastructure directly to the CEO of Huge Networks, Erick Nascimento. While Nascimento claims the incident is the result of a malicious frame job by a competitor, the technical evidence paints a complex picture of compromised systems, vulnerable hardware, and the persistent threat of weaponized IoT devices.

The Anatomy of the Campaign: A Chronology of Chaos

The mystery began to unravel earlier this month when an anonymous source provided a file archive discovered in an publicly exposed online directory. The contents were damning: a collection of Python-based malicious scripts, detailed command-line logs, and—most significantly—the private SSH authentication keys belonging to Erick Nascimento.

A Timeline of Compromise

• January 2026: Huge Networks detects a digital intrusion. Two internal development servers are breached, and personal SSH keys belonging to Nascimento are exfiltrated.
• January 11, 2026: Digital Ocean flags a specific droplet associated with Nascimento for malicious activity linked to the leaked keys. Nascimento claims he was traveling but addressed the issue upon his return, destroying the compromised droplet.
• Post-January 2026: Despite the company’s internal assertions that they wiped the affected systems and rotated security credentials, the leaked archive shows the botnet remained active, utilizing Huge Networks’ infrastructure to execute systematic attacks against regional Brazilian ISPs.
• Present Day: Huge Networks has retained a third-party forensic firm to conduct a deep-dive investigation into the extent of the initial breach and how the attacker maintained a foothold in their systems.

Technical Infrastructure: Weaponizing the Internet of Things

The botnet discovered in the archive is not a sophisticated, custom-built malware suite, but rather a classic, brutal implementation of the Mirai malware architecture. Mirai, which first gained global infamy in 2016 for taking down major portions of the internet, remains the gold standard for "dumb" but effective botnets.

The TP-Link Vulnerability

The attacker behind this specific campaign targeted a very narrow, high-value set of devices: TP-Link Archer AX21 routers. The scripts reveal a calculated effort to scan the internet for these specific routers that had not yet been updated to patch CVE-2023-1389. This vulnerability, an unauthenticated command injection flaw, allows an attacker to execute arbitrary code with root privileges. Once the device is compromised, it becomes a "zombie" node in the botnet, ready to receive instructions.

The Mechanics of DNS Amplification

The botnet’s primary weapon is the DNS reflection and amplification attack. By exploiting the DNS protocol’s tendency to provide large responses to small queries, the attackers can magnify their traffic output by 60 to 70 times.

1. The Spoof: The attacker sends a request to an open DNS resolver, spoofing the source IP address to be that of the target ISP.
2. The Response: The DNS resolver, believing it is answering the victim, sends a massive data packet to the target.
3. The Multiplier: When thousands of these infected TP-Link routers coordinate their efforts to bombard thousands of open DNS resolvers simultaneously, the resulting traffic is sufficient to saturate the bandwidth of even the most robust regional ISPs.

The leaked logs show that the attackers were highly disciplined. They restricted their activity to Brazilian IP ranges, hitting each target with four parallel processes for 10 to 60 seconds—a "surgical" strike pattern designed to cause maximum disruption while minimizing the likelihood of triggering global anomaly detection systems.

The Defense: A CEO’s Claim of Sabotage

When confronted with the evidence, Erick Nascimento expressed shock, asserting that he had no knowledge of the ongoing campaigns. He argues that the existence of his SSH keys in the archive is evidence of a sophisticated "false flag" operation.

"We received and notified many Tier 1 upstreams regarding very large DDoS attacks against small ISPs," Nascimento explained. "We didn’t dig deep enough at the time, and what you sent makes that clear."

Nascimento maintains that the initial breach in January was the work of a competitor, suggesting that the attacker deliberately left traces—like his own keys—to tarnish his firm’s reputation. He claims to have "strong evidence stored on the blockchain" that this was a targeted effort by a rival. When asked to identify the competitor, he remained tight-lipped, citing the need to maintain a "surprise factor" for an upcoming industry event.

"Coincidentally or not, your contact happened a week before an important event—one that this competitor has never participated in. And this year, they will be participating. Strange, isn’t it?"

Implications for the DDoS Mitigation Market

The situation involving Huge Networks highlights a troubling trend in the cybersecurity industry: the "democratization" of DDoS-for-hire services and the blurring of ethical boundaries.

The Market Conflict

Nascimento denies that his firm uses attacks to solicit new business, noting that the targets in the scripts—mostly small regional ISPs—are not even part of his commercial pipeline. However, the optics of the situation are catastrophic. In an industry where trust is the primary commodity, a firm being linked to a botnet—even as an exploited party—raises significant questions about their operational security (OpSec) and their ability to protect their own infrastructure.

The Persistence of Mirai

The fact that a 2016-era malware strain like Mirai can still cause massive disruption nearly a decade later speaks to the inherent insecurity of the Internet of Things. Manufacturers continue to ship devices with vulnerable firmware, and consumers rarely, if ever, update their routers. As long as millions of insecure devices remain connected to the web, they will continue to serve as the fuel for these digital fires.

Conclusion: A Cautionary Tale

The investigation into Huge Networks serves as a stark reminder that in the interconnected landscape of modern networking, a single point of failure can have wide-reaching consequences. Whether this was a case of genuine incompetence in managing infrastructure security or a calculated hit job by a malicious competitor, the fallout remains the same: innocent ISPs are offline, and the trust in a security provider has been severely shaken.

As the industry moves forward, the focus must shift not only to mitigating the attacks themselves but to auditing the providers who promise to protect us. If a "protector" can be compromised so easily, it calls into question the fundamental security of the digital ecosystems that keep our society functioning. For now, the files in the exposed archive remain a chilling testament to how easily the tools of defense can be inverted into the weapons of war.