A botnet managed by a Brazilian DDoS protection company has been discovered
A Brazilian company specializing in DDoS (Distributed Denial of Service) attack protection has been involved in a massive attack campaign against other network operators in Brazil. According to an investigation by KrebsOnSecurity, the malicious activity would have been caused by a security breach and could be the work of a competitor seeking to damage the company's reputation.
An exposed archive reveals shocking details
For years, security experts have monitored a series of massive DDoS attacks originating from Brazil and exclusively targeting Brazilian Internet Service Providers (ISPs). Until recently, it was unclear who or what was behind these digital offensives. The situation changed earlier this month when a reliable source shared an archive of files exposed in an open online directory.
The archive contained several malicious programs in Python language, written in Portuguese, as well as the private SSH authentication keys of the CEO of Huge Networks, a Brazilian ISP that primarily offers DDoS protection to other Brazilian network operators.
Who is Huge Networks?
Founded in Miami, Florida, in 2014, Huge Networks has its operational headquarters in Brazil. The company was born to protect game servers from DDoS attacks and has since evolved into a DDoS mitigation provider focused on ISPs. It does not appear in any public abuse complaints and is not associated with known DDoS-for-hire services.
Investigation results: The exposed archive shows that a threat actor based in Brazil maintained root access to Huge Networks' infrastructure and built a powerful DDoS botnet by systematically scanning the Internet for insecure Internet routers and unmanaged DNS servers that could be enlisted in the attacks.
DNS reflection attacks
The DNS (Domain Name System) allows Internet users to reach websites by typing familiar domain names instead of the associated IP addresses. Ideally, DNS servers provide responses only to machines within a trusted domain. However, DNS reflection attacks rely on misconfigured DNS servers that accept requests from anywhere on the web.
Attackers can send spoofed DNS requests to these servers so that the request appears to come from the victim's network. In this way, when the DNS servers respond, they respond to the spoofed address (victim). Aggressors can exploit a DNS protocol extension that allows large DNS messages to significantly increase the size and impact of a reflection attack.
The botnet and the CVE-2023-1389 vulnerability
The file archive includes a command history that shows exactly how the attacker built and maintained a powerful botnet by scanning the Internet for TP-Link Archer AX21 routers. Specifically, the botnet seeks TP-Link devices vulnerable to CVE-2023-1389, a known vulnerability that could allow remote code execution.
The Mirai malware and its impact
The malicious software powering the botnet of TP-Link devices used in DDoS attacks against Brazilian ISPs is based on Mirai, a malware known for causing large-scale service disruptions in the past.
This discovery raises serious concerns about the security of network infrastructures and the need for greater vigilance by companies offering DDoS protection services. Investigations are ongoing, and further details may emerge as the situation evolves.
The role of Digital Ocean
The investigations revealed that the Digital Ocean server used to coordinate the scans had been reported for abusive activity hundreds of times over the previous year. This suggests that Huge Networks' infrastructure may have been compromised more extensively than initially thought.
Attack methodology
The attacks were strictly limited to intervals of Brazilian IP addresses. The scripts show that each selected IP address was attacked for 10-60 seconds with four parallel processes per host before the botnet moved on to the next target. This methodology indicates a highly coordinated and targeted approach.
Implications for network security
This case highlights the need for greater vigilance by companies offering DDoS protection services. The compromise of a single development server had significant repercussions, demonstrating the importance of robust security measures and timely response to intrusions.
The future of Huge Networks
Huge Networks has stated that it has initiated an in-depth investigation with the help of a third-party network forensics company. Actions taken include notifying the team, cleaning compromised servers, and rotating keys. However, investigations are still ongoing, and further details may emerge.
Prevention and best practices
To prevent similar incidents, companies should adopt measures such as using secure SSH keys, continuous monitoring of network infrastructures, and timely response to reports of suspicious activity. Staff training in cybersecurity is equally crucial to prevent internal compromises.
Final conclusions
This case underscores the importance of proactive security and rapid response to cyber threats. Companies operating in the network security sector must be particularly vigilant to protect both their own infrastructures and their clients from harmful attacks.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not engage in real-time information activities.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.