Amazon has developed a new networking topology that's up to a third faster and up to 40 percent more energy efficient than traditional hierarchical network designs. The novel architecture, called Resilient Network Graphs (RNG), is based on random graph theory. "Traditional networks have always been hierarchical," explained Matt Rehder, VP of global network engineering at AWS, in a recent interview. "They're sort of like an org chart where one network device will talk to the boss network device which will talk to the next boss network device and you gotta go up the chain of command in order to talk to someone else in another department." There are reasons for that, Rehder said. Hierarchy creates structure and makes data routing rules simpler. "You don't have to know how to talk to everyone in the organization, you just talk to the person above you," he said. But that creates inefficiencies. The tree-like structure creates points of contention where data flow bottlenecks can occur. At the same time, other parts of the network may be underutilized. Rehder said that academics in 2012 proposed a random graph topology for networks. But that design, as detailed [PDF] by Amazon researchers, had issues. The reimagined network structure, dubbed Jellyfish, relied on truly random graphs and called for removing routers from server racks and locating them centrally to simplify cabling. But that approach ended up increasing latency between servers within a rack. Rehder said no one has been able to put that design into production. "It requires much more complicated routing rules to figure out how to program every device – you can't just program every device to know who everyone is, they have limited memory space," he said. "And then the other [issue] is that the cabling actually is very complicated. Part of that hierarchy is about simplifying how you build the network in the datacenter and with a random graph it's literally random and you can't just have cable spaghetti all over a datacenter. So you could build it in a lab but you could never really do it at scale." Nonetheless, said Rehder, AWS has been solving these problems over the past few years. "The only reason we were able to even think about tackling them is that 15-year history of iteratively improving our hardware development and software ownership of our network," he said. Less random Inspired by other academic networking research, AWS managed to succeed with random network topology by making it not entirely random. RNG relies on a flat graph where routers interconnect through a mix of deterministic and randomized cabling. RNG began taking shape three years ago when Seshadhri Comandur, an Amazon Scholar and professor at the University of California, Santa Cruz, answered an internal Slack message from Ratul Mahajan, a fellow Amazon Scholar, datacenter networking expert, and professor at the University of Washington, who was looking for an expert on graph theory and routing. With help from AWS principal applied scientist Giacomo Bernardi and other colleagues, AWS has become the first company to deploy a flat datacenter network at scale. AWS expects the technology will offer better performance and reliability for Amazon customers while also saving billions of dollars in hardware and reducing CO2 emissions. The reimagined network structure was referred to as Penrose internally because the original design involved Penrose tiles. But as the project evolved, AWS settled on Resilient Network Graphs "to reflect the customer benefit and that primarily is a more resilient and performant network," as a company spokesperson put it. RNG relies on a routing algorithm called Spraypoint to identify node paths and an optical device called a Shufflebox for mixing connections between routers. Rehder said the Shufflebox is one of the pieces of magic that makes RNG work. "In a random graph network you don't have that hierarchical structure where you can have all the cables neatly aligned," he explained. "So how do you do that? How do you basically make a random network feel more structured? Well, you have the Shufflebox and the idea is that you plug fiber in here and inside of this it will randomize or basically scramble the fiber. So the ports you plug in get scrambled around and come out on some random port around the other side." RNG is AWS's new network for its core database servers. Machine learning hardware uses the company's UltraServer network, because the machine learning workloads need full bandwidth. "The core server networks can be oversubscribed more efficiently," said Rehder. "Everyone's not talking to each other at the same time." RNG has been rolled out in Ireland, Germany, and Spain, and the plan is to deploy it in the majority of company datacenters by the end of the year. ®
ZTE has won three prestigious awards at Selular Award 2026, held on June 8, 2026, at Menara Peninsula Hotel, Jakarta. The awards recognize ZTE's contributions and innovations in advancing artificial intelligence (AI)-powered network technologies amid the acceleration of digital transformation and 5G development in Indonesia. ZTE's contributions to advancing AI-powered network innovation have been recognized by Selular Media Network (SMN), a leading telecommunications and technology media organization in Indonesia, through three awards at Selular Award 2026. ZTE received honors in the categories of Best AI Technology Fixed Wireless Access, Best AI Network Ecosystem, and Best Native AI Baseband. These awards reflect ZTE's capabilities across network access, ecosystem development, and core infrastructure, further strengthening its position as a technology partner supporting digital transformation and the evolution of AI-driven networks in Indonesia. The Selular Award is an annual appreciation program organized by Selular Media Network (SMN) to recognize outstanding achievements and contributions across Indonesia’s ICT and digital technology industry. As the first and most consistent telecommunications industry award since 2003, the Selular Award serves as a benchmark for excellence, honoring companies and brands that demonstrate innovation, strong performance, and meaningful contributions to Indonesia’s digital transformation. Through this award, the public and business community can identify industry leaders that continue to create value and drive progress in the digital ecosystem. This year's Selular Award carries the theme "Leading The Future: Building Exponential Value in 5G-Advanced and AI Economy", highlighting the convergence of AI and 5G-Advanced as key drivers of digital economic growth. Kevin Fang, Marketing Director of ZTE Indonesia, said: "Digital transformation today is no longer driven solely by connectivity, but also by the ability of networks to operate more intelligently, efficiently, and adaptively. Through the AI-powered innovations we have developed—from broadband access to core infrastructure—ZTE is committed to delivering network solutions that are ready to meet connectivity demands in the AI and 5G-Advanced era. These awards motivate us to continue delivering meaningful innovations that create value for the industry, our customers, businesses, and society." Indonesia's telecommunications industry is currently entering a critical phase in its digital transformation journey. According to the e-Conomy SEA 2025 report by Google, Temasek, and Bain & Company, revenue from AI-powered applications in Indonesia grew by 127% year-on-year, the highest growth rate in Southeast Asia, with 80% of users interacting with AI applications daily. This momentum reflects the growing demand for network infrastructure that is not only fast and reliable but also capable of supporting AI workloads. On the infrastructure side, GSMA Intelligence projects that 5G investment in Indonesia could contribute up to USD 41 billion to the national GDP between 2024 and 2030. This projection highlights the strategic role of 5G as a connectivity foundation that supports digital transformation and the growth of the digital economy. At the same time, the increasing adoption of AI and data-driven services is driving demand for networks that are faster, more reliable, and capable of handling greater capacity. As part of its commitment to supporting these developments, ZTE continues to deliver innovations across the entire network technology value chain, from broadband access to core infrastructure. On the access side, ZTE provides AI-powered Fixed Wireless Access (FWA) solutions designed to expand high-speed connectivity more efficiently and flexibly. The solution serves as a strategic approach to supporting broadband inclusion while addressing the growing demand for connectivity across different regions. In addition, ZTE is building an open ecosystem that integrates AI, connectivity, cloud computing, and various digital technologies within a collaborative framework involving operators and enterprises. At the core infrastructure level, ZTE embeds AI capabilities natively into the baseband, the key component responsible for network signal processing. By integrating AI directly into the baseband from the design stage, networks can analyze, optimize, and adapt operations more intelligently and in real time. This approach enables more autonomous and efficient network operations while preparing networks for the demands of the 5G-Advanced era. Moving forward, ZTE will continue to deepen collaboration with operators, enterprises, and industry partners in Indonesia while strengthening its technology portfolio, ranging from wireless access solutions and optical transport to data center infrastructure and telecommunications energy solutions. In line with Indonesia's vision of becoming one of Southeast Asia's leading digital economies, ZTE remains committed to accelerating the nation's digital transformation through AI-driven innovation, intelligent connectivity, and next-generation network technologies that benefit more industries and regions across the country. Contributed by ZTE.
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an extended campaign of massive DDoS attacks against other network operators in Brazil, KrebsOnSecurity has learned. The firm’s chief executive says the malicious activity resulted from a security breach and was likely the work of a competitor trying to tarnish his company’s public image.
An Archer AX21 router from TP-Link. Image: tp-link.com.
For the past several years, security experts have tracked a series of massive DDoS attacks originating from Brazil and solely targeting Brazilian ISPs. Until recently, it was less than clear who or what was behind these digital sieges. That changed earlier this month when a trusted source who asked to remain anonymous shared a curious file archive that was exposed in an open directory online.
The exposed archive contained several Portuguese-language malicious programs written in Python. It also included the private SSH authentication keys belonging to the CEO of Huge Networks, a Brazilian ISP that primarily offers DDoS protection to other Brazilian network operators.
Founded in Miami, Fla. in 2014, Huge Networks’s operations are centered in Brazil. The company originated from protecting game servers against DDoS attacks and evolved into an ISP-focused DDoS mitigation provider. It does not appear in any public abuse complaints and is not associated with any known DDoS-for-hire services.
Nevertheless, the exposed archive shows that a Brazil-based threat actor maintained root access to Huge Networks infrastructure and built a powerful DDoS botnet by routinely mass-scanning the Internet for insecure Internet routers and unmanaged domain name system (DNS) servers on the Web that could be enlisted in attacks.
DNS is what allows Internet users to reach websites by typing familiar domain names instead of the associated IP addresses. Ideally, DNS servers only provide answers to machines within a trusted domain. But so-called “DNS reflection” attacks rely on DNS servers that are (mis)configured to accept queries from anywhere on the Web. Attackers can send spoofed DNS queries to these servers so that the request appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (targeted) address.
By taking advantage of an extension to the DNS protocol that enables large DNS messages, botmasters can dramatically boost the size and impact of a reflection attack — crafting DNS queries so that the responses are much bigger than the requests. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This amplification effect is especially pronounced when the perpetrators can query many DNS servers with these spoofed requests from tens of thousands of compromised devices simultaneously.
A DNS amplification and reflection attack, illustrated. Image: veracara.digicert.com.
The exposed file archive includes a command-line history showing exactly how this attacker built and maintained a powerful botnet by scouring the Internet for TP-Link Archer AX21 routers. Specifically, the botnet seeks out TP-Link devices that remain vulnerable to CVE-2023-1389, an unauthenticated command injection vulnerability that was patched back in April 2023.
Malicious domains in the exposed Python attack scripts included DNS lookups for hikylover[.]st, and c.loyaltyservices[.]lol, both domains that have been flagged in the past year as control servers for an Internet of Things (IoT) botnet powered by a Mirai malware variant.
The leaked archive shows the botmaster coordinated their scanning from a Digital Ocean server that has been flagged for abusive activity hundreds of times in the past year. The Python scripts invoke multiple Internet addresses assigned to Huge Networks that were used to identify targets and execute DDoS campaigns. The attacks were strictly limited to Brazilian IP address ranges, and the scripts show that each selected IP address prefix was attacked for 10-60 seconds with four parallel processes per host before the botnet moved on to the next target.
The archive also shows these malicious Python scripts relied on private SSH keys belonging to Huge Networks’s CEO, Erick Nascimento. Reached for comment about the files, Mr. Nascimento said he did not write the attack programs and that he didn’t realize the extent of the DDoS campaigns until contacted by KrebsOnSecurity.
“We received and notified many Tier 1 upstreams regarding very very large DDoS attacks against small ISPs,” Nascimento said. “We didn’t dig deep enough at the time, and what you sent makes that clear.”
Nascimento said the unauthorized activity is likely related to a digital intrusion first detected in January 2026 that compromised two of the company’s development servers, as well as his personal SSH keys. But he said there’s no evidence those keys were used after January.
“We notified the team in writing the same day, wiped the boxes, and rotated keys,” Nascimento said, sharing a screenshot of a January 11 notification from Digital Ocean. “All documented internally.”
Mr. Nascimento said Huge Networks has since engaged a third-party network forensics firm to investigate further.
“Our working assessment so far is that this all started with a single internal compromise — one pivot point that gave the attacker downstream access to some resources, including a legacy personal droplet of mine,” he wrote.
“The compromise happened through a bastion/jump server that several people had access to,” Nascimento continued. “Digital Ocean flagged the droplet on January 11 — compromised due to a leaked SSH key, in their wording — I was traveling at the time and addressed it on return. That droplet was deprecated and destroyed, and it was never part of Huge Networks infrastructure.”
The malicious software that powers the botnet of TP-Link devices used in the DDoS attacks on Brazilian ISPs is based on Mirai, a malware strain that made its public debut in September 2016 by launching a then record-smashing DDoS attack that kept this website offline for four days. In January 2017, KrebsOnSecurity identified the Mirai authors as the co-owners of a DDoS mitigation firm that was using the botnet to attack gaming servers and scare up new clients.
In May 2025, KrebsOnSecurity was hit by another Mirai-based DDoS that Google called the largest attack it had ever mitigated. That report implicated a 20-something Brazilian man who was running a DDoS mitigation company as well as several DDoS-for-hire services that have since been seized by the FBI.
Nascimento flatly denied being involved in DDoS attacks against Brazilian operators to generate business for his company’s services.
“We don’t run DDoS attacks against Brazilian operators to sell protection,” Nascimento wrote in response to questions. “Our sales model is mostly inbound and through channel integrator, distributors, partners — not active prospecting based on market incidents. The targets in the scripts you received are small regional providers, the vast majority of which are neither in our customer base nor in our commercial pipeline — a fact verifiable through public sources like QRator.”
Nascimento maintains he has “strong evidence stored on the blockchain” that this was all done by a competitor. As for who that competitor might be, the CEO wouldn’t say.
“I would love to share this with you, but it could not be published as it would lose the surprise factor against my dishonest competitor,” he explained. “Coincidentally or not, your contact happened a week before an important event – one that this competitor has NEVER participated in (and it’s a traditional event in the sector). And this year, they will be participating. Strange, isn’t it?”
Accedi
