Hunt.io Detects New BraZetsu Access‑Broker Infrastructure Months Before Public Disclosure
What Happened – Hunt.io examined TLS certificate data against the indicators of compromise (IOCs) published by Group‑IB for the BraZetsu initial‑access broker. The analysis showed that the command‑and‑control (C2) hostnames had migrated to new servers and certificates as early as April 2026, well before the August 2026 public write‑up. BraZetsu continues to sell compromised Windows machines that have been pre‑loaded with tools to harvest ERP, SCADA, EDR, and certificate data.
Why It Matters for Trust & Control Assurance
- The episode illustrates how threat actors can maintain a “stable” foothold by re‑using TLS certificates, a tactic that evades signature‑based detection and highlights the need for continuous external‑threat monitoring.
- Organizations that rely on third‑party services (e.g., cloud hosts, managed providers) must prove they have ongoing vendor‑risk oversight and evidence‑based assurance that any external infrastructure they consume is free of known malicious activity.
- Mapping this incident to a control objective around third‑party risk management enables a defensible audit trail that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Enterprises across sectors that use ERP, SCADA, or other critical Windows‑based workloads—particularly manufacturing, energy, and financial services—are prime targets of BraZetsu’s brokered access.
Recommended Actions
- Integrate TLS‑certificate intelligence feeds into your continuous monitoring platform to flag any external hostnames that appear on known malicious IOCs.
- Review and tighten vendor‑risk processes: require evidence that cloud or hosting providers regularly scan for and remediate compromised infrastructure.
- Document the monitoring results as part of your audit evidence for third‑party risk controls.
Technical Notes – BraZetsu is a Python‑based framework compiled with Nuitka, used by the Brazilian actor “Exilware.” It leverages Let’s Encrypt certificates on port 443 to hide C2 traffic. The primary C2 hostname c2.installscenter.com migrated to a secondary server on April 4 2026, sharing the same IP as painel.installscenter.com, both hosted by the Swedish provider Njalla. The seed server originated from Contabo and switched to a placeholder domain painel.seu-dominio.com in February 2026, a pattern repeated 17 times over five weeks. Source: Security Affairs