Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Brazilian ISP botnet DDoS campaign

Campaign
First reported
Last updated
Happening score
H score 49
1 unique sources, 1 articles

Summary

Hide ▲

The Brazilian ISP botnet DDoS campaign has been linked to a Brazil-based threat actor that repeatedly hit Brazilian network operators over several years. The operation matters because it combined Internet-wide scanning, DNS reflection abuse, and a botnet of compromised routers and servers to generate massive attack traffic. Newly exposed operational files also tie the activity to Huge Networks infrastructure and show the attacks were confined to Brazilian IP ranges.

Related Happenings

NCSC-UK joint advisory on covert botnets and proxy networks

Public Sector Action
First: 23.04.2026 15:28 Last: 23.04.2026 15:28 Sources 1

About this happening: **NCSC-UK** and partner agencies issued a **joint advisory** warning that **China-nexus hackers** are using **hijacked consumer devices** as covert proxy networks to hide maliciou...

Open Happening

Operation PowerOff DDoS-for-hire takedown

Law Enforcement
First: 17.04.2026 09:40 Last: 17.04.2026 09:40 Sources 1

About this happening: Europol and partners in 21 countries carried out Operation PowerOff, disrupting a DDoS-for-hire/booter-service ecosystem. The coordinated action took down 53 domains, seized infra...

Latest development: 17.04.2026 14:30

Europol-led Operation PowerOff involved police and cybersecurity agencies from 21 countries and disrupted DDoS-for-hire infrastructure by taking down 53 domains, seizing databases linked to over three million criminal user accounts, removing over 100 advertising URLs, and arresting four people suspected of providing DDoS-for-hire services.

Open Happening

Operation PowerOFF DDoS-for-hire arrests and takedowns

Law Enforcement
First: 17.04.2026 01:26 Last: 17.04.2026 01:26 Sources 1

About this happening: Authorities participating in Operation PowerOFF disrupted DDoS-for-hire and booter infrastructure across 21 countries, arresting four suspects and taking 53 domains offline. The a...

Latest development: 17.04.2026 14:30

Europol-led Operation PowerOff involved police and cybersecurity agencies from 21 countries and disrupted DDoS-for-hire infrastructure by taking down 53 domains, seizing databases linked to over three million criminal user accounts, removing over 100 advertising URLs, and arresting four people suspected of providing DDoS-for-hire services.

Open Happening

APT28 FrostArmada DNS hijacking and AitM credential theft campaign

Campaign
First: 07.04.2026 18:51 Last: 07.04.2026 18:51 Sources 1

About this happening: A multinational disruption effort has taken down **FrostArmada**, an **APT28** campaign that hijacked router DNS settings to steal **Microsoft account credentials** and OAuth toke...

Open Happening

FBI, DOJ, and Poland take FrostArmada infrastructure offline

Law Enforcement
First: 07.04.2026 18:51 Last: 07.04.2026 18:51 Sources 1

About this happening: Authorities carried out a **takedown** of **FrostArmada** infrastructure, disrupting an **APT28** credential-theft operation that hijacked router traffic to steal Microsoft logins...

Open Happening

Timeline

  1. 30.04.2026 17:04 1 articles · 27d ago

    Digital Ocean flags Huge Networks droplet compromise

    Detection Ioc Update

    Digital Ocean flagged a Huge Networks droplet on January 11, 2026 as compromised due to a leaked SSH key, and Huge Networks says it wiped the affected boxes and rotated keys after a January 2026 intrusion that affected two development servers and Erick Nascimento’s personal SSH keys.

    Show sources
    Open in new tab
  2. 30.04.2026 17:04 2 articles · 27d ago

    Investigative report links Huge Networks to Brazilian ISP DDoS botnet

    Initial Disclosure

    An investigative report linked Huge Networks, a Brazilian DDoS mitigation provider centered in Brazil, to an extended botnet campaign that mass-scanned insecure Internet routers and unmanaged DNS servers, used TP-Link Archer AX21 devices vulnerable to CVE-2023-1389, and launched massive DDoS attacks against Brazilian ISPs from Brazilian IP ranges.

    Show sources
    Open in new tab