Hunt.io Finds New BraZetsu Access Broker Infrastructure Months Before Disclosure

Hunt.io traced BraZetsu infrastructure and found it had already moved to new hosting months before Group-IB published its August 31 report on the Python-based initial access broker tied to Brazilian actor Exilware. The stable signal was not IPs or hashes but the pattern: painel. and c2. prefixes on a nonstandard port on a VPS running Hestia Control Panel.

• C2 host c2.installscenter.com used TLS on a second server since April 4
• Panel painel.installscenter.com and C2 shared one IP at provider Njalla
• Placeholder painel.seu-dominio.com appeared 17 times over five weeks
• TLS services on 80.78.27.252 went quiet after June 20