Can RPKI help mitigate social engineering attacks?#

Sanjaya, APNIC (with Carlos Martinez, LACNIC)

• Why: A rare public postmortem of a hijack executed through humans, not protocol weakness — and a direct answer to whether RPKI would have stopped it.
• What: LACNIC address space was hijacked intermittently in July 2025 by a rogue AS with a repeat-offender history across multiple RIR regions. The investigation (LACNIC → APNIC → APJII/IDNIC) found the bad actor had hijacked the ASN itself and convinced a multinational transit provider to provision transit using forged company letterhead and a faked domain — short random BGP advertisements followed. The transit provider terminated service on the victim's report; the case was jointly written up as a community case study.
• How: Incident timeline and escalation-path walkthrough; the stated lessons map the defenses: a ROA with correct maxlength prevents the prefix hijack, and ASPA blocks unauthorized upstream providers — the exact door the attacker walked through.
• Where applicable: General — any resource holder. Its main value is the honest gap analysis: ROV stops origin forgery but not social engineering at your transit provider; ASPA (or contractual LOA verification) is the missing control.