Article

2026-11-05 Cyber

Direct Translation via Google Translate. Edited

Text taken from the Telegram channel of darpaandcia
[ColonelCassad] How a Free VPN Became the Largest Botnet: The Story of Hola and Luminati

It all began in 2012 in the coastal Israeli city of Netanya, when two veterans of the local telecom industry, Ofer Vilensky and Derry Shribman (who had previously sold their startup to Cisco for a profit), founded Hola. The idea seemed brilliant and noble: to give the world a free, revolutionary P2P VPN.

The service didn't require payment—millions of users worldwide rushed to download the Hola browser extension and mobile apps to watch blocked Netflix, download torrents, and bypass local censorship. But free cheese in cyberspace always comes at a price: security.

The fine print of the license agreement concealed a legal caveat: by installing Hola, the user agreed to become an intermediary for a so-called affiliate network. This affiliate network turned out to be Vilensky's secretive B2B division, Luminati Networks. While some people were watching TV shows through a free VPN, their home IP address and internet were being rented out to large corporate clients at exorbitant per-gigabyte rates.

Israeli engineers essentially built the largest commercial botnet in history, using tens of millions of volunteer users as "drops." But in May 2015, this lie was exposed. Fredrick Brennan, owner of the popular portal 8chan, faced a colossal DDoS attack that standard security gateways couldn't filter. The traffic was coming from real home computers around the world running Hola. It turned out that an unknown customer had simply approached Luminati, paid money, and exploited a network of unsuspecting users to bring down the site.

A scandal erupted: security researchers discovered critical vulnerabilities in Hola's code that allowed for the remote execution of arbitrary code on users' machines. The service was declared a threat, and a mass removal from extension directories began. However, Vilensky didn't even consider closing down the business. He simply confirmed: yes, we are selling your internet; we never concealed this in the agreement.

Their business proved so profitable that in 2017, the British private equity firm EMK Capital acquired a controlling stake in Luminati for nearly $200 million. And in 2021, to finally shed the toxic taint of botnet scandals, the company underwent a major rebranding and changed its name to Bright Data.

Who is really behind this structure? As with the developers of the Pegasus spyware, Bright Data's core staff and management hail from Unit 8200 (the Israeli equivalent of the NSA) and elite military cyber units. In Israel, the line between offensive state cyber operations, OSINT collection, and the commercial market is traditionally blurred.

The Bright Data network has become the primary shadow tool for Western intelligence contractors, private detective agencies, US government agencies, and geopolitical monitoring institutions. It can be used to conduct deep reconnaissance (WEBINT), scan enemy secure databases, manipulate social media algorithms, and download restricted resources of other countries without the slightest risk of diplomatic repercussions.

And recently, Bright Data published a new patent.

Modern smartphone operating systems and stores like Google Play have declared war on hidden proxy apps: they are being scrubbed and access blocked. User software has become an unreliable channel. This is why Bright Data is moving to the next level of parasitism—hardware.

The official narrative behind the new patent is as follows: the engineers are allegedly concerned with protecting ordinary users from intrusive website surveillance, digital fingerprint tracking, and geoblocking. But, remembering the company's history, we understand: this is a covert cyber intelligence (OSINT) infrastructure deployed directly in the apartments and cars of users who are unaware of it—including those tempted by a free router from their internet service provider (these scenarios are described in the patent).

The essence of what the patent describes is an intermediate device in the living space: a separate "box" or module integrated with a router or sensor. Inside, a browser runs without a graphical interface, emulating another device or user and disguising requests as normal home traffic. Sections of the patent mention household appliances, smart homes, and automotive CAN, LIN, and MOST buses.

After this, the spy network no longer needs to send suspicious requests from its servers. Instead, the data collection command is sent to a smart microwave or router. The device emulates a real browser on the fly, using a real home IP address from a provider like Rostelecom, generates a digital fingerprint, and downloads sensitive target data. To the target server, it appears as if the average citizen simply opened a webpage in a browser.

The stealth logic described in the patent deserves special attention. The system includes "idle state" analysis algorithms. The device literally monitors its owner: it reads accelerometer data, monitors network load drops, screen shutdowns, and battery controller status. As soon as you park the car or turn off the monitor, the "parasite box" activates and begins transmitting reconnaissance traffic.

Why is this necessary on a global scale? Under the guise of "marketing research," an invisible army of bots is deployed, capable of hacking government portals, scanning enemy infrastructure vulnerabilities, and collecting classified data sets, bypassing any national firewall. And in the event of a block or investigation, the router owner—an ordinary person who didn't even realize their home internet was being used by foreign intelligence—takes the brunt.

# id) ?>

Posted by badanov 2026-11-05 00:00|| E-Mail|| Front Page|| ||Comments [19 views ] Top

03:59 Grom the Reflective
03:41 Grom the Reflective
03:39 Grom the Reflective
03:32 Grom the Reflective
03:30 Grom the Reflective
03:26 Grom the Reflective
03:18 Grom the Reflective
02:15 Seeking Cure For Ignorance
Merry-Go-Blog