Anti-DDoS Firm Heaped Attacks on Brazilian ISPs

Summary: KrebsOnSecurity reported that an exposed online file archive contained Portuguese-language Python attack scripts and the private SSH keys of Huge Networks CEO Erick Nascimento, a Brazilian DDoS mitigation provider, showing a botnet built by mass-scanning for TP-Link Archer AX21 routers vulnerable to CVE-2023-1389 and misconfigured DNS servers for reflection attacks. The scripts attacked Brazilian IP prefixes for 10-60 seconds with four parallel processes per host, and Nascimento said the activity stemmed from a January 2026 breach of two development servers and his personal SSH keys via a shared bastion server, while maintaining he has blockchain-stored evidence a competitor was responsible.
What's compelling: A company whose product is DDoS protection was, per the leaked archive, the source infrastructure for sustained attacks on small Brazilian ISPs - and the CEO's explanation rests on a single compromised jump server and a competitor he won't name.

Read the original at Krebs on Security ↗

Topics: Endpoint & Network Security
Mentions: CVE-2023-1389
Related: CVE-2023-1389: TP-Link Archer AX-21 Command Injection Vulnerability Known Exploited Vulnerabilities · May 01, 2023
Trinity Cyber + Grey Noise: Sharing Intelligence to Protect Internet Citizens Cyber Risks ·
Grey Noise Round Up: Product Updates - May 2023 Cyber Risks ·