Brazilian DDoS Protection Firm Compromised, Botnet Targets Local ISPs
Patch all TP‑Link Archer AX21 routers to the latest firmware, rotate any compromised SSH keys, and audit for unauthorized access to prevent future botnet activity.
Patch all TP‑Link Archer AX21 devices to the latest firmware, rotate all SSH keys, audit for unauthorized access, and monitor DNS traffic for reflection patterns.
Summary
A Brazilian DDoS protection provider, Huge Networks, was breached in January 2026, allowing an attacker to build a botnet that targeted Brazilian ISPs with massive DDoS attacks. The botnet scanned the Internet for TP‑Link Archer AX21 routers that were vulnerable to CVE‑2023‑1389, an unauthenticated command‑injection flaw patched in April 2023. The attacker used private SSH keys belonging to Huge Networks’ CEO, Erick Nascimento, to control the botnet, coordinating the scans from a Digital Ocean droplet that had been flagged for abusive activity. The malicious Python scripts limited attacks to Brazilian IP ranges, attacking each target for 10‑60 seconds with four parallel processes before moving on. The botnet’s malware was Mirai‑based, leveraging DNS reflection and amplification to increase attack payloads.
Huge Networks has since rotated keys, wiped compromised servers, and hired a third‑party forensics firm. The incident highlights the risk of legacy devices and exposed credentials in a DDoS‑mitigation environment.
The breach underscores the need for timely firmware updates on IoT devices and rigorous SSH key management to prevent similar attacks.
Key changes
- Botnet used TP‑Link Archer AX21 routers exploiting CVE‑2023‑1389
- Private SSH keys of CEO Erick Nascimento were used to control the botnet
- Scanning coordinated from a Digital Ocean server flagged for abuse
- Attacks were limited to Brazilian IP ranges, 10‑60 seconds per target
- Malware was Mirai‑based, leveraging DNS reflection and amplification