Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure

Hunt.io analyzed BraZetsu — a Python-based initial access broker used to harvest Windows hosts for ERP/SCADA/EDR artifacts — and found that while published IOCs (hashes, IPs) became obsolete, TLS certificate naming conventions and hosting patterns (panel prefixes, nonstandard ports, Hestia Control Panel setups) remained stable and provided a better basis for detection; the report highlights that defenders should chase patterns not the IP of the month.