As reported by Security Affairs, Hunt.io's analysis of the BraZetsu initial access broker reveals that its underlying infrastructure continued to evolve and adapt months before public indicators of compromise (IOCs) became outdated. This highlights a critical challenge in threat intelligence: the ephemeral nature of attacker infrastructure versus the persistence of operational patterns.
BraZetsu, an initial access broker tool, targets Windows machines, specifically looking for ERP software, SCADA systems, and EDR products. The operators behind it, known as Infected Marketplace, sell compromised machine access to other threat actors who then deploy ransomware or conduct financial fraud. Hunt.io focused on analyzing TLS certificate data associated with BraZetsu's command and control (C2) infrastructure, rather than reversing the malware binaries again. They discovered that the C2 hostname, c2.installscenter.com, had already shifted to a new server with updated TLS certificates by April 4, nearly five months before Group-IB's report was published in August. This new server shared an IP address with the control panel hostname, painel.installscenter.com, and both were hosted by Njalla. Earlier infrastructure, initially hosted by Contabo, showed a pattern of using a placeholder domain name, painel.seu-dominio.com, which frequently updated its certificate, indicating continuous operation. Even after migrating to a new provider, the operators maintained similar habits, using the same Hestia Control Panel setup with a 'painel' prefix. Hunt.io emphasizes that focusing on these persistent operational patterns, such as the naming conventions and hosting configurations, provides a more stable detection signal than chasing rapidly changing IP addresses or file hashes.
Source: Security Affairs
