Free tools Windows power users keep installed
One-click scans. No signup required.
Hunt.io found new BraZetsu-linked infrastructure by starting from an IP address that Group-IB had already published, then pivoting through certificate records, hostnames, ports, DNS and hosting data instead of reverse-engineering the malware again. Its inventory shows the command hostname c2.installscenter.com presenting TLS on a second VPS at 80.78.27[.]252 from April 4, 2026, almost five months before Group-IB’s August 31 analysis. The lead that lasted longer than the IP was not an address at all. It was a naming and port pattern: a painel. or c2. hostname on a port other than 443, on a server running Hestia Control Panel.
What “months before disclosure” refers to
The headline involves three dates, and they are easy to conflate. Group-IB’s public analysis of BraZetsu appeared on August 31, 2026. Hunt.io’s report, which connected the new hosts to that malware, was published on October 6, and Security Affairs covered it on October 8. The April 4 observation predates all of them. It sits in Hunt.io’s certificate inventory, which Hunt.io queried with its HuntSQL tool after Group-IB published, using the published indicators as starting points. The infrastructure was therefore visible in certificate data months before the malware was publicly described, but the link to BraZetsu was drawn in October, after those queries.
As an Amazon Associate I earn from qualifying purchases.
BraZetsu as Group-IB describes it
Group-IB describes BraZetsu as a Windows malware framework written in Python and compiled with Nuitka. Its analysts tracked five versions between February and May 2026. The early versions focused on basic remote access, and later ones added broader reconnaissance for initial-access-broker work. Julio Guapo Menezes, Malware Analyst, and Miguel Salazar, Cyber Threat Intelligence Analyst, at Group-IB put the distinction in their August 31 analysis this way: “BraZetsu, by contrast, operates as an Initial Access Broker (IAB) malware framework rather than a financial fraud tool.”
What it profiles and collects
- It profiles systems for commercial value, including banking, ERP, e-commerce, industrial/SCADA and security products.
- Its collection or discovery activity covers browser history, CNAB financial remittance files (the Brazilian banking format for payment files), and digital certificates in .pfx and .p12 form.
- Group-IB counts 27 distinct functions in the latest version it analyzed, most of them for enumeration and reconnaissance.
How it receives instructions
According to Group-IB, BraZetsu retrieves a Base64-encoded, XOR-obfuscated C2 configuration from a Pastebin dead drop, and it uses a WebSocket connection over TLS in the framework Group-IB analyzed.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Where access is sold
Group-IB describes the Infected Marketplace as a place where customers buy access to compromised hosts and may deploy secondary payloads. It reports a minimum deposit of BRL 30.00, paid through NowPayments. That is an entry deposit to the marketplace, not a price for any one compromised host, and it says nothing about what victims lose.
CNABHunter is a separate tool
Group-IB distinguishes BraZetsu from CNABHunter, a separate fraud-oriented tool. Overlap in the directories the two touch does not mean BraZetsu edits payment files on its own. In BraZetsu’s case, CNAB files are a discovery target.
Attribution
Group-IB attributes the framework to the Brazilian actor Exilware with high confidence. That is Group-IB’s assessment, not a proven identity.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
How Hunt.io pivoted from a published IP
Hunt.io started from the seed IP 38.242.246[.]176 and worked outward in four steps, as its October 6 report describes them:
- Build a certificate timeline for the seed IP.
- Expand searches using tokens taken from the hostnames associated with the cluster.
- Check each newly identified IP against ASN records, reverse DNS and Certificate Transparency data.
- Admit a common name into the cluster only when it meets at least two of three conditions: it matches a reported hostname; it shares an IP with a published hostname in the same time window; or it uses a port already associated with the cluster.
The final rule matters most. A single signal, such as a shared port or a generic-looking hostname, is not enough to pull a host into the cluster. The attribution rests on the joins between certificates, hostnames, ports, DNS, provider data and time.
Timeline of the infrastructure
Each row below is a dated record from Hunt.io’s data sources, not a current status check.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
| Date (2026) | What Hunt.io recorded | What the record signals |
|---|---|---|
| Jan. 4–Feb. 2 | Contabo default hostname on seed IP 38.242.246[.]176, 80 observations in Hunt.io’s inventory | Earliest record in the timeline; the seed host still carried its provider’s default name |
| Feb. 11–Mar. 17 | Certificate common name changed to painel.seu-dominio.com on port 8083; 17 observations at intervals of two to four days | Consistent with a panel left running rather than a brief landing page, per Hunt.io. “Seu-dominio” is Portuguese for “your domain.” |
| Mar. 21–22 | installscenter.com registered; Let’s Encrypt certificates issued for painel. and c2.installscenter.com; new host 80.78.27[.]252 | Hunt.io associates the new host with Njalla |
| Mar. 22–26 | Passive DNS shows c2.installscenter.com resolving to 80.78.27[.]252, then moving behind Cloudflare | After the move, ordinary DNS lookups no longer reveal the server address |
| Apr. 4 | First observation of c2.installscenter.com presenting TLS on port 2083 at 80.78.27[.]252 | Earliest record tying the C2 hostname to this host |
| From Apr. 6 | painel.installscenter.com on ports 8443 and 8083 at the same IP | Places the C2 and panel names on one host under one apex domain. Hunt.io describes 8083 as Hestia Control Panel’s default admin port and notes that 8443 matches the WebSocket port in the malware analysis it used. |
| June 16–20 | TLS services at 80.78.27[.]252 go quiet by June 20 | The pattern Hunt.io describes held from February to June; this host’s services end here |
| Oct. 2 | Wildcard certificates for the domain issued | Per Hunt.io, these certificates alone do not show that the C2 is live |
Why the pattern lasted longer than the address
Hunt.io’s summary of the case puts the stable element in the naming and setup rather than the address:
Recommended Free Tools
“The pattern is more stable: a painel. or c2. prefix on a port that isn’t 443, on a VPS running Hestia Control Panel. It held from February to June across two providers, and that’s what we’d build detection on, not the IP.”
Hunt.io, company report, October 6, 2026
| Indicator | What the reporting shows about its durability | Caveat |
|---|---|---|
| Single IP address | Two different addresses carried the setup at different times; the second host’s TLS services had gone quiet by June 20 | Goes stale when services stop, and says little about the next host |
| File hash | Group-IB tracked five versions between February and May 2026 | A new build produces a new hash |
| Hostname prefix (painel., c2.) | Hunt.io says the pattern held from February to June across two providers | Both words are common, and they can match legitimate servers, so the prefix needs a second signal |
| Port and panel setup (8083, 8443, Hestia) | Similar JARM fingerprints on ports 8083 and 8443 indicate a similar Hestia setup | JARM is a fingerprint of how a TLS server responds to probes; a setup alone does not identify a host, since legitimate servers use it too |
How much the evidence supports
| Claim | Basis | Qualifier |
|---|---|---|
| Hostnames, ports and dates at the two addresses, February to June | Certificate inventory, passive DNS and Certificate Transparency records | Hunt.io’s dated measurements |
| The second VPS continues the same setup | Hunt.io’s reading of the sequence of observations | Medium confidence, per Hunt.io |
| One operator runs both hosts | Shared Let’s Encrypt issuance and similar JARM fingerprints | Not established. Common Let’s Encrypt fingerprints are generic, and similar JARM fingerprints point to a similar setup rather than one operator. Hunt.io says the evidence does not identify the operator. |
| Exilware is behind BraZetsu | Group-IB’s malware analysis | Group-IB’s high-confidence assessment, not a proven identity |
| Victim impact of the infrastructure | Hunt.io’s investigation | Not established. Hunt.io did not access the panels and recovered no victim data. |
Defensive checks
The pattern supports a targeted hunt, with verification before any block.
Quick Recap
- Search certificate records for painel. and c2. names, and flag any that appear on a port other than 443. Certificate Transparency logs are the public source Hunt.io used.
- Pull passive DNS history for each match, noting which IP addresses each name resolved to and when, including periods when a CDN proxy sat in front.
- Review outbound traffic from your environment to those names and to nonstandard TLS ports. The report’s examples are 2083, 8083 and 8443.
- Before blocking any address, confirm whether it currently serves TLS, which certificate and SSH key it presents, and who owns it. Hunt.io reports that the second host later served a different service and SSH key, and it recommends checking before blocking the IP.
- Store each indicator with its observation date so that stale entries can be retired rather than accumulating.
Endpoint behaviors to hunt for
- Software and registry enumeration
- Browser-history collection
- Discovery of .pfx and .p12 certificate files
- Discovery of CNAB remittance files
When a match turns up
- Your own server running Hestia Control Panel on 8083: confirm ownership and inventory. Hunt.io warns that 8083 and painel.* naming can occur on legitimate Portuguese-language servers, so review the match before any block.
- An unknown host with an active TLS service that fits the pattern: treat it as a priority lead, verify it as in step 4, and escalate.
- A historical match with no current service: keep it as a historical indicator for retrospective review. It is not proof of current activity.
- An IP on a blocklist alone: blocking the historical address will not cover a pattern that has moved between hosts.
Sources
- Hunt.io, “Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure via TLS Certificates,” October 6, 2026. Primary source for the method, timeline, indicators and limitations.
- Group-IB, “Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem,” August 31, 2026. Primary source for malware behavior, the marketplace model and attribution.
- Security Affairs, “Hunt.io Finds New BraZetsu Infrastructure Months Before Disclosure,” October 8, 2026. Secondary coverage of Hunt.io’s investigation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
