Note sull'episodio
Brian Krebs published a piece on April 30th about Huge Networks, a Brazilian DDoS protection firm whose own infrastructure was used to launch a sustained botnet campaign against small Brazilian ISPs. The botnet was a Mirai variant running on compromised TP-Link routers. The exposed file archive included private SSH keys belonging to the firm's CEO, Erick Nascimento. Nascimento told Krebs the activity was the work of a competitor trying to tarnish his company's image, and that he has strong evidence stored on the blockchain of who did it, but he won't share the evidence because it would lose the surprise factor.
The Legacy Sysadmin opens by pointing out this is the fourth time this exact story has surfaced in nine years. The original Mirai authors turned out to co-own a DDoS mitigation firm in 2017. A May 2025 incident traced to the same Brazilian operator hit Krebs's own site with a 6.3 terabit attack. The FBI seized several DDoS-for-hire services run by that operator. And now Huge Networks. Same country in three of the four. Same business model in all four.
The Paranoid CISO declines to speculate about attribution and instead works through what the artifacts in the archive actually show. The Startup Founder steel-mans the CEO's defense as far as it can go, and discovers that's not very far. The Goat Farmer's Counsel notices that he doesn't miss this part.
Source Article:
"Anti-DDoS Firm Heaped Attacks on Brazilian ISPs" by Brian Krebs, KrebsOnSecurity, April 30, 2026. https://krebsonsecurity.com/2026/04/anti-ddos-firm-heaped-attacks-on-brazilian-isps/
The panel: The Legacy Sysadmin, The Startup Founder, The Paranoid CISO, The Goat Farmer's Counsel.