Digital Siege: Brazilian DDoS Protection Firm Implicated in Botnet Operations

In a jarring revelation that underscores the fragility of the internet’s infrastructure, a Brazilian technology company—whose primary business mandate is to shield networks from distributed denial-of-service (DDoS) attacks—has been identified as a critical operator behind a massive, long-running botnet.

Huge Networks, a firm founded in Miami in 2014 with core operations based in Brazil, has been implicated in a series of digital sieges targeting the very infrastructure it claims to protect. According to evidence obtained by KrebsOnSecurity, the company’s own internal assets were used to orchestrate systematic attacks against regional Brazilian internet service providers (ISPs). The discovery, which involves leaked SSH authentication keys and malicious Python scripts, has sent shockwaves through the cybersecurity community, raising questions about the ethics of the DDoS mitigation industry and the security of the devices that form the backbone of our digital lives.

The Discovery: A Trail of Digital Breadcrumbs

For years, security researchers have observed a peculiar pattern of high-volume DDoS traffic originating from Brazil, exclusively targeting local ISPs. While the source remained elusive, the mystery unraveled earlier this month when an anonymous source provided a file archive retrieved from an exposed, publicly accessible directory.

The archive served as a "smoking gun." It contained a suite of Portuguese-language malicious programs written in Python and, most damningly, the private SSH authentication keys belonging to Erick Nascimento, the CEO of Huge Networks. These keys provided the necessary credentials to command the infrastructure used to build and manage a sophisticated botnet.

The botnet, in turn, was engineered to scour the internet for vulnerable hardware. Specifically, the scripts targeted TP-Link Archer AX21 routers, exploiting a known command injection vulnerability (CVE-2023-1389). By hijacking these devices, the perpetrators created a distributed army of nodes capable of launching high-volume DNS reflection and amplification attacks—a technique that leverages misconfigured DNS servers to multiply the volume of traffic directed at a target, effectively knocking them offline.

Chronology of a Silent Breach

The timeline of the incident, according to internal company records and external indicators, suggests a protracted period of exploitation.

• January 2026: Huge Networks experiences an internal security breach. Two development servers and the CEO’s personal SSH keys are compromised via a bastion/jump server that was accessible to multiple employees.
• January 11, 2026: Digital Ocean, the cloud provider hosting the compromised assets, flags the activity. Nascimento claims he was traveling at the time and addressed the issue upon his return by wiping the servers and rotating keys.
• Early 2026 to Present: Despite the supposed remediation, evidence from the leaked archive shows that threat actors continued to use Huge Networks’ infrastructure to conduct periodic, rapid-fire DDoS strikes against Brazilian ISPs.
• April 2026: The leaked archive is discovered by independent investigators, exposing the link between the company’s internal keys and the malicious botnet activity.

The Mechanics of the Botnet: DNS Amplification

The botnet identified in the leak is a textbook example of modern, high-impact cyber warfare. By utilizing the DNS protocol, the attackers managed to turn innocent servers into weapons.

DNS reflection attacks rely on the fact that many DNS servers are improperly configured to accept queries from any source on the internet. By spoofing the IP address of the target, the attacker sends a query to these open servers; the servers then respond, but instead of sending the response to the requester, they send it to the spoofed IP address—the victim.

The "amplification" component is where the impact reaches massive scales. By requesting DNS records that trigger large responses, attackers can ensure the victim receives a packet 60 to 70 times larger than the initial request. When this is performed by tens of thousands of compromised TP-Link routers simultaneously, the resulting traffic surge is sufficient to saturate even the most robust enterprise-grade bandwidth, effectively rendering an ISP’s network invisible to its customers.

Huge Networks’ Response and Defense

When presented with the findings, Erick Nascimento, CEO of Huge Networks, offered a nuanced defense. He acknowledged the security breach in January but vehemently denied that his firm was responsible for the subsequent attacks.

"We received and notified many Tier 1 upstreams regarding very large DDoS attacks against small ISPs," Nascimento stated. "We didn’t dig deep enough at the time, and what you sent makes that clear."

Nascimento posits that the continued use of his credentials after the January remediation is evidence of a persistent and sophisticated adversary—specifically, a competitor. He claims to have "strong evidence stored on the blockchain" that this campaign was a "false flag" operation designed to ruin his company’s reputation.

"I would love to share this with you, but it could not be published as it would lose the surprise factor against my dishonest competitor," Nascimento added, noting that the exposure of these files occurred just one week before a major industry event in which his unnamed competitor is slated to participate for the first time.

Furthermore, Nascimento challenged the motive behind the attacks. He noted that the target list contained in the scripts consisted of small, regional providers that were not in his company’s client base or sales pipeline. "We don’t run DDoS attacks against Brazilian operators to sell protection," he asserted. "Our sales model is mostly inbound and through channel integrators, not active prospecting based on market incidents."

Broader Implications: The "Protection" Paradox

The situation at Huge Networks highlights a recurring, darker trend in the DDoS mitigation industry. Since the emergence of the Mirai malware in 2016, the line between "protection" and "perpetration" has frequently blurred.

In the early days of Mirai, the authors themselves were operators of a DDoS mitigation firm, using their own botnet to attack gaming servers—creating a demand for the very services they provided. While Nascimento denies such a strategy, the optics are undeniably problematic. When a firm responsible for network security is found to have its private keys embedded in the code of an active botnet, it creates an atmosphere of deep distrust.

This incident also serves as a critical reminder of the dangers posed by "Internet of Things" (IoT) devices. The TP-Link Archer AX21, while a popular consumer device, remains a prime target for botnet herders because of the sheer volume of units that remain unpatched. When users fail to update their firmware, they are not just leaving their own networks vulnerable; they are unwittingly donating their bandwidth to criminal enterprises.

Conclusion: A Call for Accountability

As the investigation continues, the cybersecurity community is left with more questions than answers. Is this a case of a malicious competitor performing a highly targeted character assassination, or is it a failure of internal security governance at a firm entrusted with protecting critical infrastructure?

Regardless of the truth, the incident serves as a stark warning. The infrastructure of the internet is only as strong as its weakest link. In this case, that link appears to have been the internal security practices of a single, mid-sized firm. For Brazilian ISPs, the fallout is real—service disruptions, financial losses, and a lingering sense of insecurity.

As digital threats become more sophisticated and the tools of the trade become more accessible, the industry must grapple with the reality that the defenders of the internet are often operating within the same ecosystem as its predators. Until there is greater transparency and more rigorous accountability in the DDoS mitigation sector, the cycle of "protection" and "sabotage" will likely continue unabated.