A Brazilian anti-DDoS firm, Huge Networks, suffered a breach in January 2026, compromising its CEO's SSH keys and development servers. Threat actors gained root access to Huge Networks' infrastructure, building a Mirai-based botnet by exploiting CVE-2023-1389 in TP-Link Archer AX21 routers to launch massive DNS amplification DDoS attacks against other Brazilian ISPs.
Initial Access
Bastion Breach
confirmed
An intrusion in January 2026 compromised a bastion/jump server and the personal SSH keys of Huge Networks' CEO, Erick Nascimento, providing initial access to the company's resources.
Defender cut points
Implement strong access controls and regular auditing for bastion hostsEnforce phishing-resistant MFA for all administrative accessRegularly rotate and secure SSH keys
