NETSCOUT recorded 487,415 DDoS attacks in Brazil in the first half of 2026, up 3.56% from 470,677 in the previous half, according to Teletime. Telecommunications accounted for 175,023 of them, 35.9% of the total, mostly aimed at wireless operators (fixed networks added up to 27,967), according to TeleSíntese. NETSCOUT itself notes that the figures reflect what its own infrastructure observes and are not a census.
Network operators tend to treat DDoS attacks on ISPs as something that arrives from outside and gets handled at the edge. The same report describes residential proxy networks that originate attack traffic from consumer IP addresses, which puts part of the problem inside subscribers' homes. Mitigation still happens at the edge. Hygiene across the CPE fleet (firmware, admin password, exposed services, settings that come back after a factory reset) is the ISP's job, and with thousands of devices in the field it can't be done one unit at a time.
Where do DDoS attacks on ISPs come from?
Part of the attack traffic comes from compromised home devices, and that traffic is hard to filter. A botnet on rented servers uses data center addresses, which the edge can recognize fairly easily, while a residential IP with a history of normal traffic slips through any coarse filter. In the summary of the NETSCOUT report, residential proxies supply source addresses that look like those of ordinary subscribers, and the company recommends more selective mitigation, with more scrubbing capacity at the ISP's edge.
In December 2025, at an event hosted by NIC.br (the organization that runs Brazil's .br domain and core internet services), Nokia executive Craig Labovitz estimated that about 25 million Brazilian home devices are repeatedly involved in attacks, as reported by TeleSíntese. That's a speaker's estimate and doesn't carry the weight of official data. His list includes connected TVs, cameras, Android apps and free software, and, in his words, the threat is usually the network itself.
How does a subscriber's CPE end up in a DDoS attack?
A CPE ends up in a DDoS attack either after being compromised and pulled into a botnet, or as an amplification reflector. The DDoS recommendations from CERT.br, Brazil's national computer emergency response team, list CPEs, Wi-Fi routers and broadband modems among the devices used in botnets, alongside cameras, computers and phones. Those other devices also sit in the subscriber's home, outside the ISP's management, so the CPE isn't even the main source. It is the part the ISP can standardize.
Compromise usually comes through old firmware with a known flaw or a factory default admin password, and it gets worse when the web management interface answers on the WAN. Support teams see this all the time with routers subscribers bought at a store and never changed the password on.
In amplification, the attacker sends small queries with the victim's address spoofed, and the device sends the victim much larger responses. CERT.br names DNS, NTP and SSDP among the services with a high amplification factor and notes that CPEs often ship with them enabled. In Brazil, DNS amplification was the second most frequent attack vector of the half-year, with 61,575 occurrences, according to the same TeleSíntese report.
What the edge handles and what the CPE fleet handles
An attack in progress is mitigated at the edge and upstream, with scrubbing, selective filtering and spare transit capacity, and no CPE setting changes that. On egress, the anti-spoofing filtering described in BCP 38 (RFC 2827) drops packets from your subscriber base that carry forged source addresses, which takes away a compromised device's ability to launch reflection attacks against third parties. The RFC warns that the filter doesn't protect against floods from valid addresses, and that is exactly the residential proxy case.
Updated firmware and closed exposed services reduce, month after month, how many devices in your base can be recruited or used as reflectors, with no effect on the attack happening right now.
How do you update firmware on thousands of CPEs safely?
To update firmware at scale without knocking subscribers offline, the ISP needs to test on a small batch and have an automatic brake for when failures pile up. In IXC ACS, mass firmware updates work like this:
- Filter the fleet by vendor, model, hardware version and current firmware. Hardware matters because the same commercial model can have revisions that don't accept the same file.
- Apply the file to 2 or 3 devices and check that WAN and Wi-Fi came back as they were.
- Schedule the batch for a low-traffic window, since the device reboots when it writes the firmware.
- Track updated, rejected and pending devices on the dashboard. If more than 30% fail, reject the file or time out, the system stops the task, and the retry option only targets the ones that failed.
The ACS only reaches CPEs pointed at it, so low provisioning coverage leaves part of the fleet out (the guide on ACS URL setup in multi-vendor networks covers this). What works on each device depends on model and firmware certification. More than 230 models are certified, and a router the subscriber bought on their own may not be one of them. Behind CGNAT, the command waits for the CPE's next inform.
IXC ACS doesn't detect or mitigate DDoS and doesn't identify infected devices. Its role is to standardize and fix the CPEs it manages.
What happens when the subscriber does a factory reset?
A factory reset brings back the default password and the services you had turned off. Support teams know the scene well. The connection freezes some random night, the subscriber holds down the reset button and the device goes back to the state it was in when it came out of the box.
Automatic reconfiguration through presets handles that return. When the CPE talks to the ACS again after the reset (which depends on how provisioning was set up), the system identifies the device, checks the preset and reapplies the preconfiguration defined by the ISP, with parameters such as web access, WAN and LAN DNS, NTP and remote access. The same screen lists the models that don't support a given parameter, so you can already see which devices will need different handling.
For anything outside the preconfiguration, such as a service the model only exposes in the TR-069 data tree, there are two paths. At scale, IXC ACS technical support runs mass parameter changes at the ISP's request, sent on each device's next inform, with a final report listing model, firmware, serial number and what changed. Case by case, a tier 2 agent can ask the AI assistant to find and write the parameter without going through a screen, and it first checks what that model supports.
CPE fleet hygiene checklist
CPE fleet hygiene starts with an inventory and is kept up with periodic review.
- Survey the fleet by vendor, model, hardware and firmware, highlighting old versions that account for many devices.
- Measure how many active CPEs are pointed at the ACS. Anything left out falls outside every item below.
- Set an admin password policy, with no factory passwords and no single password for the whole fleet.
- Turn off web and remote management on the WAN wherever nobody uses it, and check, model by model, whether DNS, SSDP/UPnP or NTP answer on the external interface.
- Set a monthly firmware window, with a test batch and a low-traffic time slot.
- Factory reset one device of each model on the bench and check what comes back configured and what doesn't.
- Confirm with the edge team that egress anti-spoofing is active.
- Repeat the review every quarter, because new models enter the base all the time.
Frequently asked questions
Can a customer's router be used in a DDoS attack? Yes. CERT.br includes CPEs, Wi-Fi routers and modems among the devices used in botnets, and many ship with DNS and SSDP enabled, services that can be abused for amplification.
Does updating CPE firmware stop DDoS attacks? An attack in progress is still mitigated at the edge and upstream. Updating reduces how many devices in your base can be recruited, so it helps in the medium term, alongside mitigation.
What is a residential proxy in a DDoS attack? It's a network of home devices, such as TVs, cameras and phones running certain apps, that relays third-party traffic through the subscriber's home IP. According to NETSCOUT, this makes attack traffic look like legitimate demand.
Is the ISP liable for a loaned router used in an attack? It depends on the contract and the equipment loan terms, so the answer has to come from your legal team. On the technical side, loaned equipment belongs to the ISP, and the ISP decides how to update and standardize it.
Where to start in your operation
Start with two numbers almost nobody knows offhand: how many different firmware versions are running in your fleet today, and how many active CPEs are pointed at the ACS. With those you can estimate the size of the job and go first after the models that combine many devices with old firmware. The conversation about mitigation and anti-spoofing with the edge team runs in parallel, on a different budget and timeline.
If you'd like to see mass firmware updates and automatic reconfiguration on your own fleet, click the button below to talk to our team.