Hunt.io Maps BraZetsu Access-Broker Infrastructure Across Two VPS Providers

Oct 6, 2026 · Original article ↗

Summary

Hunt.io used certificate, DNS and scan data to link BraZetsu-associated panel and C2 infrastructure across Contabo and Njalla VPSs. The services went quiet in June; the researchers recommend hunting naming and port patterns.

Key points

The research pivots from the published seed IP 38[.]242[.]246[.]176 to 80[.]78[.]27[.]252, where c2[.]installscenter[.]com and painel[.]installscenter[.]com appeared on separate ports.
Certificate and scan records show the panel and C2 hostnames on ports 8083, 8443 and 2083, with Hestia Control Panel indicators.
The researchers assess that the infrastructure likely moved from Contabo to Njalla, with medium confidence; the evidence does not identify the operator.
The second VPS's TLS services went quiet by 20 June. A different SSH key and an nginx Laravel login were later observed there.
BraZetsu is described in prior reporting as a Python Windows framework used by an initial-access broker; this investigation did not reverse-engineer the malware or recover victim data.
The article recommends hunting certificate and hostname patterns alongside non-standard ports, while warning that generic Hestia indicators can produce false positives.

Article Details

Attack Vectors: BraZetsu retrieves a Pastebin dead-drop, Base64-decodes and XOR-decrypts it with p4st3_s3cr3t_k3y, and uses the resulting domain, port, and token for command-and-control configuration.
The published analysis describes the live command channel as WebSocket over TLS on port 8443; the infrastructure hunt also identified C2 on port 2083 and a panel on ports 8083 and 8443.
The reported framework profiles systems for ERP, SCADA, and EDR software and searches for .pfx/.p12 certificates and CNAB files; the report says it returns a dossier to the broker.
The published reporting describes a v1 Run key persistence value named MonitorSystem.
The shop inventories compromised Windows hosts and sells access to them; the article says follow-on activity may be carried out by other buyers.
Defensive Notes: Re-run the certificate-name hunt weekly and alert on new painel.* or c2.* certificates on ports 2083, 8083, or 8443.
Review matches before blocking: the article warns that Hestia's default admin port and Portuguese painel.* names can produce false positives.
Use first-seen and review dates when adding infrastructure to blocklists because the reported infrastructure rotates; verify 80.78.27[.]252 before blocking because its services and SSH key changed after the reported operator window.
On endpoint detections, look for unsigned Nuitka-compiled executables, Chromium History files copied into %TEMP%, .pfx enumeration, and the MonitorSystem Run key value.
If a host is affected, isolate it and preserve %TEMP% and the Run key before cleanup; check for follow-on activity by other actors.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`caixaentradas1inboxshop[.]site`	The published report links this delivery domain to an Ousaban sample.
DOMAIN	`infect[.]online`	Older shop infrastructure identified in the published reporting.
DOMAIN	`infectonline[.]store`	Domain tied to the access-broker shop in the published indicators.
HOSTNAME	`c2[.]installscenter[.]com`	Published BraZetsu command hostname, observed on the VPS at port 2083.
HOSTNAME	`painel[.]installscenter[.]com`	Panel hostname observed on the same VPS as the C2, on ports 8083 and 8443.
IPV4	`38[.]242[.]246[.]176`	Published seed VPS associated with BraZetsu reporting and AgenteV2 overlap; the hunt observed panel infrastructure on it.
IPV4	`80[.]78[.]27[.]252`	VPS that hosted the reported C2 hostname and Hestia panel infrastructure from April to June 2026.
SHA256	`0c65d06ecd5a4bcd214128cc5ae2fd48f449a7b0e4002c6f0e127486b90df1b5`	Certificate fingerprint for c2.installscenter[.]com on port 2083, observed 4 April to 17 May.
SHA256	`0cd0cc49ea4ff48c675368f725e183608494f22fefa92d2f33577f70bb6c0d5d`	BraZetsu sample hash listed in the published reporting.
SHA256	`0fa785bb9f95b113539bb909da88e6cac9a433a07935571d9bcd2d85746fc5bf`	BraZetsu sample hash listed in the published reporting.
SHA256	`10de6185e31539cf01c8b05d9559e65e8693efd695f315de54667ef8c04de39c`	BraZetsu sample hash listed in the published reporting.
SHA256	`1510823e7c80b4db5333dd18cd5992881496da30032d6d69b2a82e1c5cf30246`	BraZetsu sample hash listed in the published reporting.
SHA256	`30af2ec2437af0f4910d528440715540dbec6a5587f86f327316a7a781c1e2fe`	BraZetsu sample hash listed in the published reporting.
SHA256	`3f2f48525cf082672e38808480e214775e03dd943ff2df86172665aad96a5eaa`	BraZetsu sample hash listed in the published reporting.
SHA256	`473ade701a602a14d50a869762df72d1a1ca7cd395bf26b9e090d9116a447726`	Certificate fingerprint for painel.installscenter[.]com on ports 8083 and 8443.
SHA256	`54e313434a7f3fa349e439857e23ab536a95c9927cf62f8358b5cdd9fabf2700`	BraZetsu sample hash listed in the published reporting.
SHA256	`67fcfbdaab397ad1273135a3c6aa1d220ab76491cf945df081503401cc9732d2`	BraZetsu sample hash listed in the published reporting.
SHA256	`731f269e44e3372e214e48ebaf0a05a892e914422a1fa664fb25a0fe2200528a`	Certificate fingerprint for c2.installscenter[.]com on port 2083, observed 22 May to 4 June.
SHA256	`91f225dcc7a01f926b03e8540d8b5e2d6c8e3763cc30f57381d702ce638fa6b0`	BraZetsu sample hash listed in the published reporting.
SHA256	`93bb4a4812e77ddc17c2722340d915bd5c8387316bbdbc394c201a28cb9b7c88`	BraZetsu sample hash listed in the published reporting.
SHA256	`96960409b6e1abf20eeb689d9e0a170008a15096de6a06ca5ae0d5aa56579042`	BraZetsu sample hash listed in the published reporting.
SHA256	`ab5c83564a38a035819a601e2e2f40c4ad07d0c12625bbb196ab4e915b087f86`	Certificate fingerprint for painel.seu-dominio[.]com on the published seed IP.
SHA256	`bc91f90a5677404cf9c8f4bed7b36c22027b1549ffefee129b41fab3db3108b8`	BraZetsu sample hash listed in the published reporting.
SHA256	`c4dd46e5b450349fd9fbf686a5a22f55f8371123b098104db663a3980646e138`	BraZetsu sample hash listed in the published reporting.
SHA256	`cd8fc8effea20d28e76c53f3386c783e55dcb309e1525b27f7a141d51b6f6c78`	BraZetsu sample hash listed in the published reporting.
SHA256	`d881a60ccd03b5417a1eed184143a18a333e7e9e9e351596a7a765843643af99`	BraZetsu sample hash listed in the published reporting.
SHA256	`f775fe06a4c2563cb03e1aa42eb4e9532840cce9dc168ea2ca97cee7972e6b17`	BraZetsu sample hash listed in the published reporting.
URL	`hxxps[:]//pastebin[.]com/raw/9ChwVzzw`	Published Pastebin dead-drop used to provide C2 configuration.
URL	`hxxps[:]//pastebin[.]com/raw/aF0WCxia`	Published Pastebin dead-drop used to provide C2 configuration.
URL	`hxxps[:]//pastebin[.]com/raw/hM0nXNBP`	Published Pastebin dead-drop used to provide C2 configuration.