A Brazilian tech agency that makes a speciality of defending networks from distributed denial-of-service (DDoS) assaults has been enabling a botnet answerable for an prolonged marketing campaign of large DDoS assaults in opposition to different community operators in Brazil, KrebsOnSecurity has discovered. The agency’s chief government says the malicious exercise resulted from a safety breach and was doubtless the work of a competitor attempting to tarnish his firm’s public picture.
An Archer AX21 router from TP-Hyperlink. Picture: tp-link.com.
For the previous a number of years, safety consultants have tracked a sequence of large DDoS assaults originating from Brazil and solely focusing on Brazilian ISPs. Till lately, it was lower than clear who or what was behind these digital sieges. That modified earlier this month when a trusted supply who requested to stay nameless shared a curious file archive that was uncovered in an open listing on-line.
The uncovered archive contained a number of Portuguese-language malicious applications written in Python. It additionally included the personal SSH authentication keys belonging to the CEO of Large Networks, a Brazilian ISP that primarily affords DDoS safety to different Brazilian community operators.
Based in Miami, Fla. in 2014, Large Networks’s operations are centered in Brazil. The corporate originated from defending sport servers in opposition to DDoS assaults and advanced into an ISP-focused DDoS mitigation supplier. It doesn’t seem in any public abuse complaints and isn’t related to any recognized DDoS-for-hire companies.
Nonetheless, the uncovered archive reveals {that a} Brazil-based menace actor maintained root entry to Large Networks infrastructure and constructed a strong DDoS botnet by routinely mass-scanning the Web for insecure Web routers and unmanaged area identify system (DNS) servers on the Internet that may very well be enlisted in assaults.
DNS is what permits Web customers to achieve web sites by typing acquainted domains as a substitute of the related IP addresses. Ideally, DNS servers solely present solutions to machines inside a trusted area. However so-called “DNS reflection” assaults depend on DNS servers which are (mis)configured to just accept queries from anyplace on the Internet. Attackers can ship spoofed DNS queries to those servers in order that the request seems to return from the goal’s community. That method, when the DNS servers reply, they reply to the spoofed (focused) deal with.
By profiting from an extension to the DNS protocol that permits massive DNS messages, botmasters can dramatically increase the scale and affect of a mirrored image assault — crafting DNS queries in order that the responses are a lot greater than the requests. For instance, an attacker might compose a DNS request of lower than 100 bytes, prompting a response that’s 60-70 instances as massive. This amplification impact is particularly pronounced when the perpetrators can question many DNS servers with these spoofed requests from tens of hundreds of compromised gadgets concurrently.
A DNS amplification and reflection assault, illustrated. Picture: veracara.digicert.com.
The uncovered file archive consists of a command-line historical past exhibiting precisely how this attacker constructed and maintained a strong botnet by scouring the Web for TP-Hyperlink Archer AX21 routers. Particularly, the botnet seeks out TP-Hyperlink gadgets that stay weak to CVE-2023-1389, an unauthenticated command injection vulnerability that was patched again in April 2023.
Malicious domains within the uncovered Python assault scripts included DNS lookups for hikylover[.]st, and c.loyaltyservices[.]lol, each domains which were flagged prior to now 12 months as management servers for an Web of Issues (IoT) botnet powered by a Mirai malware variant.
The leaked archive reveals the botmaster coordinated their scanning from a Digital Ocean server that has been flagged for abusive exercise a whole bunch of instances prior to now 12 months. The Python scripts invoke a number of Web addresses assigned to Large Networks that had been used to determine targets and execute DDoS campaigns. The assaults had been strictly restricted to Brazilian IP deal with ranges, and the scripts present that every chosen IP deal with prefix was attacked for 10-60 seconds with 4 parallel processes per host earlier than the botnet moved on to the following goal.
The archive additionally reveals these malicious Python scripts relied on personal SSH keys belonging to Large Networks’s CEO, Erick Nascimento. Reached for remark concerning the information, Mr. Nascimento stated he didn’t write the assault applications and that he didn’t notice the extent of the DDoS campaigns till contacted by KrebsOnSecurity.
“We acquired and notified many Tier 1 upstreams concerning very very massive DDoS assaults in opposition to small ISPs,” Nascimento stated. “We didn’t dig deep sufficient on the time, and what you despatched makes that clear.”
Nascimento stated the unauthorized exercise is probably going associated to a digital intrusion first detected in January 2026 that compromised two of the corporate’s improvement servers, in addition to his private SSH keys. However he stated there’s no proof these keys had been used after January.
“We notified the crew in writing the identical day, wiped the containers, and rotated keys,” Nascimento stated, sharing a screenshot of a January 11 notification from Digital Ocean. “All documented internally.”
Mr. Nascimento stated Large Networks has since engaged a third-party community forensics agency to analyze additional.
“Our working evaluation to this point is that this all began with a single inner compromise — one pivot level that gave the attacker downstream entry to some assets, together with a legacy private droplet of mine,” he wrote.
“The compromise occurred by way of a bastion/leap server that a number of individuals had entry to,” Nascimento continued. “Digital Ocean flagged the droplet on January 11 — compromised as a result of a leaked SSH key, of their wording — I used to be touring on the time and addressed it on return. That droplet was deprecated and destroyed, and it was by no means a part of Large Networks infrastructure.”
The malicious software program that powers the botnet of TP-Hyperlink gadgets used within the DDoS assaults on Brazilian ISPs is predicated on Mirai, a malware pressure that made its public debut in September 2016 by launching a then record-smashing DDoS assault that stored this web site offline for 4 days. In January 2017, KrebsOnSecurity recognized the Mirai authors because the co-owners of a DDoS mitigation agency that was utilizing the botnet to assault gaming servers and scare up new shoppers.
In Might 2025, KrebsOnSecurity was hit by one other Mirai-based DDoS that Google referred to as the biggest assault it had ever mitigated. That report implicated a 20-something Brazilian man who was working a DDoS mitigation firm in addition to a number of DDoS-for-hire companies which have since been seized by the FBI.
Nascimento flatly denied being concerned in DDoS assaults in opposition to Brazilian operators to generate enterprise for his firm’s companies.
“We don’t run DDoS assaults in opposition to Brazilian operators to promote safety,” Nascimento wrote in response to questions. “Our gross sales mannequin is usually inbound and thru channel integrator, distributors, companions — not energetic prospecting based mostly on market incidents. The targets within the scripts you acquired are small regional suppliers, the overwhelming majority of that are neither in our buyer base nor in our industrial pipeline — a truth verifiable by way of public sources like QRator.”
Nascimento maintains he has “robust proof saved on the blockchain” that this was all completed by a competitor. As for who that competitor is perhaps, the CEO wouldn’t say.
“I’d like to share this with you, but it surely couldn’t be printed as it might lose the shock issue in opposition to my dishonest competitor,” he defined. “Coincidentally or not, your contact occurred per week earlier than an essential occasion – one which this competitor has NEVER participated in (and it’s a standard occasion within the sector). And this 12 months, they are going to be taking part. Unusual, isn’t it?”
Unusual certainly.
